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1-1 SYSTEM CONCEPT 



Figure 1-1.1 



1-2 TRANSPARENCY 



1-3 WARRANTY 



The EM- 180 Diagnostic Emulator is a microprocessor test and diagnosis 
instrument designed to emulate the Z-80 or Z-80A microprocessors. The 
Diagnostic Emulator consists of an Operator's Station with Keyboard and Display 
Panel and an Emulator Pod and Cables for connection to the user's system. The 
EM- 180 is fast and easy to use and includes many diagnostic capabilities for 
troubleshooting problems in the user's system. 

The EM-180B is a high-speed version of the EM- 180 designed to emulate the 
Z-80B microprocessor at its full rated speed. The use and operation of the EM- 
180B is identical to the EM-180. 




^KKSSSSSS 



The EM-180 Diagnostic Emulator is transparent to the normal operation of the 
target system in that emulation is in real-time, with no additional processor cycles 
required as a result of the emulation process. There are no target system 
addresses or I/O ports needed or used by the EM-180 and there are no 
programs or other software objects that are required to be in the target address 
space. As a consequence of this transparency, the user should not experience 
difficulties in using the EM-180 Diagnostic Emulator with his system even if there 
are critical software timing constraints in his system. 

Applied Microsystems Corporation (AMC) warrants that the articles furnished 
hereunder are free from defects in material and workmanship and perform to 
applicable published AMC specifications for one year from date of shipment. 
This warranty is in lieu of any other warranty expressed or implied. In no event 
will AMC be liable for special or consequential damages as a result of any 
alleged breach of this warranty provision. The liability of AMC hereunder shall be 
limited to replacing or repairing, at its option, any defective units which are 
returned F.O.B. AMC's plant. Equipment or parts which have been subject to 
abuse, misuse, accident, alteration, neglect, unauthorized repair or installation are 
not covered by warranty. AMC shall have the right of final determination as to 
the existence and cause of defect. When items are repaired or replaced, the 
warranty shall continue in effect for the remainder of the warranty period, or for 
90 days following date of shipment by AMC, whichever period is longer. 
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1-4 GENERAL 

SPECIFICATIONS 



Input Power 

90 to 140 Vac 

60 Hz 

less than 50 watts 

Optional 

180 to 280 Vac 

50 Hz 

less than 50 watts 

Physical: 
Operators Station 

Width: 292 mm (11.5 inches) 

Height: 117 mm (4.6 inches) 

Depth: 356 mm (14 inches) 

Target System Connection (Ribbon Cable) 

Total Length (including Pod) : 

1.5M (58 inches) 

Emulator Cable Pod 

Length: 157 mm (6.2 inches) 

Width: 90 mm (3.6 inches) 

Depth: 33 mm (1.3 inches) 

Total Weight 4.5 Kg (11 lbs); 
Shipping 6.3 Kg (14 lbs) 

Environmental: 

Operating Temperature: 0°C to 40°C (32°F to 104 °F) 
Storage Temperature: -40°C to 70°C (-40°F to 158°F) 
Humidity: 5% to 95% RH non-condensing 

Operators Station 



356mm (14") j 




Emulator Pod 

1.03m (40.5") 





- 292mm (11.5") - 


! 
117mm 
(4. 6") 






i 





157mm 
" (6.2") " 



280mm 

(ir 



h?3™y^ 33mm < 1 - 3 "> 



40 DIP 
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2-1 


Operator's Station 


2-2 


Emulator Probe 


2-3 


Keyboard 


2-4 


Diagnostic EPROM Socket 


2-5 


Display Panel 


2-6 


Trace Memory 


2-7 


Back Panel Controls and 




Connectors 


2-8 


RAM Overlay 


2-9 


Disassembler 
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2-1 OPERATOR'S STATION 



2-2 EMULATOR PROBE 



2-3 KEYBOARD 



24 DIAGNOSTIC 

EPROM SOCKET 



2-5 DISPLAY PANEL 



2-6 TRACE MEMORY 



The EM- 180 Operator's Station consists of a Keyboard, Display Panel, 
Diagnostic EPROM Socket, Back Panel Controls and Connectors. It contains 
most of the system electronics, including the emulation control circuitry, Trace 
Memory, Breakpoint Comparators, plus control firmware with preprogrammed 
test routines. A RAM Overlay option may be included. See Figure 2-1.1. 



The EP-Z80 (EP-Z80B) is the Emulator Probe for the Z-80 microprocessor. The 
Probe contains the CPU and associated circuitry and buffers. It connects to the 
Operator's Station via 40-inch ribbon cables and to the target system CPU socket 
via 11-inch ribbon cables and a 40-contact DIP connector. 



The Keyboard has 32 keyswitches divided into four groupings: Processor 
Control, Mode Select, Subfunction Control and Data Entry. 



A low insertion force EPROM socket to accept EPROMs compatible with Intel 
2716 or 2732 types (single +5 power supply and Intel pinout). The user may 
create his own system test and diagnosis routines, program the EPROM with 
these routines, insert the EPROM into the EM- 180 front panel socket and then 
execute the routines in a convenient manner from the EM- 180 Keyboard. See 
Section 8: USER IMPLEMENTED CODE FUNCTIONS. 



The Display Panel consists of LED dot-matrix address and data displays and of 
individual LED indicators. Address and data information are displayed in 
hexadecimal notation. The individual indicator LEDs are divided into five 
groupings: Fault indicators (CLK, RESET) show loss of system clock or a 
continuous RESET condition; Machine Cycle indicators (Ml, Ml', BKPT, EXT, 
IORQ, IACK, RD, WR) readout the control bus and other information acquired 
during target program execution; the microprocessor condition code bits (S, Z, 
H, P/V, N, C) are also displayed on these indicators; CPU Status indicators 
(IENA, INT, NMI, BUSR, Wait, Halt, Pause) show the condition of the 
emulated target system CPU; Breakpoint Enable (BKPT ENA) is illuminated if 
the Breakpoint System is enabled. 



The Trace Memory is a 252-word by 32-bit memory that captures information 
from each bus cycle of the emulated target system microprocessor. The 
information recorded is: the 16 address bits, 8 data bits, CPU read and write 
signals, the type of bus cycle (i.e., op-code fetch, I/O, or Interrupt 
Acknowledge) and two possible breakpoint sources— the Breakpoint 
Comparators and the External Breakpoint input. 



10 
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Figure 2-1.1. Operator's Station 



4 Digit Hexadecimal 
Display for 16-Bit 
Address Readout 



(Optional RAM 
Overlay, Inside) 



Operator's 

Station 

Assembly 



Back Panel 



Diagnostic Routine 
EPROM Socket (User 
Programmed 2716 or 
2732, Switch Selectable) 



2 Digit Hexadecimal 
Display for 8-Bit 
Data Readout 



40-inch 

Connecting 

Cable 




18 Indicators for 
Bit-Status Readout 



/ 

4 Processor 

Control 
Keyswitches 



4 Subfiinction 

Control 

Keyswitches 



Keyboard Legend 



8 Mode Select 
Keyswitches 



16 Data Entry Keyswitches 
(Code and Register Access, 
Breakpoint Control, I/O 
and Memory Access) 
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Figure 2-7.1. Back Panel 



Main 

Power 

Switch 



(Optional RAM Overlay) 
Section 5) 



RAM Bank B 

Address 

Switch 



Fuses: 

115 Vac-IA 
230 Vac- 1/2 A 



RAM Bank B 

Enable 

Switch 




IE 

7HPT \ 

Power Input \ Option 

115 Vac, 60 Hz, \ Switches 

(230 Vac, 50 Hz \ (Section 9-2) 

option available) 

Baud Rate 
Select Switch 



Emulator Probe 
Connectors 



Auxiliary 
Connector 
(Section 9-1) 
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2-7 BACK PANEL CONTROLS 
AND CONNECTORS 



2-8 RAM OVERLAY 



The Back Panel of the EM-180 includes the controls and various connectors 
used to connect the Diagnostic Emulator with power, the Emulator Probe and 
other external equipment: 

Main Power Switch 

Controls the primary power to the unit. 

Baud Rate Selector Switch 

A 16-position switch is used to control the transmission rate of serial data flow 
between the Diagnostic Emulator and peripheral equipment. The baud rate 
selection options are visible on the Back Panel template shown in Figure 2-7.1. 

Auxiliary Connector 

A 25-pin, D subminiature female connector. It provides RS-232C signals and 
additional control signals to auxiliary equipment (i.e., signature analyzer, 
oscilloscope, target system, development system). See Section 9-1. 

Option Switches 

These switches control characteristics of the EM-180 RESET circuitry and 
communications interface. The normal switch positions for most users are shown 
in Figure 2-7.1. The EM-180 is shipped from the factory in this configuration. 
Alternative positions are discussed and illustrated in Section 9-2. 

RAM Overlay Bank A and Bank B Address Switches 

Two 16-position switches are used to select the address range to which the A 
and B blocks of enabled overlay memory responds. See Section 5, RAM 
Overlay. 

RAM Overlay Bank A and Bank B Enable Switches 

Two 3-position toggle switches control the A or B block of overlay memory. The 
left position (OFF) disables a memory block, effectively removing it from the 
system. The center position (READ) enables the memory block for read-only 
operations (read-only-memory simulation) . The right position (RD/WR) enables 
a memory block for both read and write operations. 



The EM-180 may be configured to include optional overlay memory. This 
feature consists of 8K bytes of 200 nsec static memory that is divided into two 
independent 4K byte blocks. Each block may be enabled as read-write memory, 
used as read-only memory or disabled. Back Panel switches are used to adjust 
each memory block to reside in any one of 16 address blocks in the target 
address space. When a memory block is enabled, it is mapped into the target 
address space, overlaying the user's system in the address block selected. The 
overlay memory may be loaded from the target system memory, front panel 
EPROM or external device by executing the appropriate Code Function. See 
Section 5, RAM Overlay. 
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2-9 DISASSEMBLER 



The EM- 180 may be configured with an optional firmware package that provides 
for formating and output of system information to an ASCII terminal device with 
RS-232C interface such as a CRT or hard copy terminal. The disassembly 
firmware extracts information from the EM- 180 Trace Memory and emulation 
processor registers, formats the data for display with instruction op-codes given in 
standard Zilog mnemonic form (JP, ADD, PUSH, SET, LD, etc.) and outputs 
the data through the serial port. See Section 6. 
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3-2 Safety Information 
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3-1 OPERATING VOLTAGE 



3-2 SAFETY INFORMATION 



3-3 CONNECTION TO TARGET 
EQUIPMENT 



Figure 3-3. 1 . Installing 40-pin plug. 



The EM- 180 Diagnostic Emulator is normally supplied for operation from 90 to 
140 Volts AC at 58 to 62 Hz line. The unit is also available for operation from 
180 to 280 Volts AC at 48 to 52 Hz line if specified at time of order. The 
EM- 180 uses a regulating transformer that also has the advantage of providing 
good blocking of conducted noise that may be present on the power input to 
the unit. 



The EM-180 is supplied with a 3-wire cord with a 3-terminal polarized plug for 
connection to the power source and protective ground. The ground terminal of 
the plug is connected to the metal chassis parts of the instrument. Electric-shock 
protection is provided if the plug is connected to a mating outlet with a 
protective ground contact that is properly grounded. 

The internal (logic) ground of the EM-180 is not connected to the protective 
ground, but floats to the same potential as the equipment to which the unit is 
connected. The user is cautioned that it is conceivable that grounding conflicts 
could occur if the EM-180 is connected to two different items of equipment with 
differing ground potentials such as the target equipment and a RS-232C terminal. 



First connect the emulator probe to the EM-180 operator station. Then remove 
the target system microprocessor from its socket and plug in the 40-pin plug. Be 
sure to observe correct pin 1 orientation. (See Figure 3-3.1) 

CAUTION: NOTE CORRECT PIN 1 ORIENTATION 
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Apply power to the EM- 180 and the target system after the unit is properly 
connected to the target circuitry. Once power is applied to the Diagnostic 
Emulator and the clock begins operating, it performs a Power-on-reset operation 
during which the following functions are performed: 

1. Reset CPU. 

2. Clear Trace Memory and CPU Registers. 

3. Clear the program starting address to zero (the default starting address) 
and display the address. 

4. The Diagnostic Emulator awaits further input from the operator. 

After the EM- 180 is connected to the target system and power is applied to both 
the EM- 180 and the target system, perform the following checks to verify that 
the unit is operating correctly: 

1. The Clock Fault and Reset Fault indicators are not illuminated. This 
means that the system clock oscillator is operating and is being received 
by the EM- 180 and that there is not a continuous RESET signal from the 
target system. 

2. The PAUSE indicator should be illuminated. This indicates that no target 
program is executing and that the EM-180 is awaiting operator commands. 

3. At power on time, the ADDRESS Display should indicate 0000. If it 
does, the EM-180 internal control program is operating. 

If all is well, proceed to operate the Diagnostic Emulator as appropriate. See 
Section 4 for details of EM-180 functions. 
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EM-180 FUNCTIONS 



4-1 Execution Control 

4-2 Examination and Alteration 
of CPU Registers 

4-3 Examination and Alteration 
of Memory Locations 

4-4 Examination and Alteration 
of I/O Ports 
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4-1 EXECUTION CONTROL 



4-1.0 RESET Keyswitch 



4-1.1 RUN Keyswitch 



EM-180 FUNCTIONS 

A basic function of the EM-180 is to emulate the target system microprocessor. 
Effectively, the Diagnostic Emulator is a pin-compatible functional replacement 
for the microprocessor in the target system. The unit is designed to meet the 
timing specifications of the emulated processor and to minimize the increase in 
electrical loading of the user's system. 

The EM-180 is always in one of two modes: RUN or PAUSE. If in the RUN 
mode, the EM-180 is emulating the target system microprocessor and executing 
the target system program at full system speed. The Trace Memory will be active 
(unless inhibited by external control) and all bus cycles of the emulated 
microprocessor are recorded for possible later display. In the PAUSE mode, 
emulation of the target system microprocessor is suspended and the operator is 
able to perform other functions such as manually examining or altering memory 
locations, I/O ports or internal registers of the emulated microprocessor; the 
operator may also review the history of the target program execution from the 
Trace Memory or execute one of the Code Function routines. 



The operator controls the EM-180 primarily through the Operator's Station 
Keyboard. Keyswitch groupings are designed for easy understanding and 
convenient use. The EM-180 display provides the operator with information 
about program execution, CPU status and EM-180 conditions. Table 4-1.1 
defines the Display Panel indicators. 



The red RESET Keyswitch always resets the microprocessor and initializes 
the EM-180 in the PAUSE mode. At this time the Address Display shows 
the program starting address. The program starting address may be changed 
at this time by entering digits with the hexadecimal keyswitches, or the 
current program starting address may be used . 

The option switches accessible at the Back Panel of the EM-180 may be used to 
set up one of several options concerning the RESET circuitry of the EM-180 and 
the target system. See Section 9-2. 



Pressing the RUN Keyswitch causes the EM-180 to execute the target program 
beginning at the preset address or continuing from the last instruction executed. 
Execution is at full system speed with no extra wait states beyond those 
commanded by the target system. The activity of the executing program is 
recorded continuously in the Trace Memory. It is also possible to obtain a 
general view of the program activity by watching the displays. For example, it is 
possible to tell if the program is in a tight loop or ranging widely in the program 
address space by observing changes in the Address Display. 
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4-1.2 RUN BKPT Keyswitch 



4-1.3 STEP Keyswitch 



This Keyswitch starts the EM-180 running the target program in real time, as 
does RUN, except the breakpoint-stop circuitry is enabled. If a breakpoint is 
detected, the EM-180 will pause before executing the next instruction, and the 
display will show the cycle where the breakpoint was detected. Pressing RUN 
BKPT again will cause execution to resume until the breakpoint is again 
detected. The breakpoint-stop circuitry may be disabled during program 
execution by pressing RUN. 



Pressing the STEP Keyswitch while the program is running causes the program 
execution to stop. The displays at this point show the operation code fetch cycle 
of the last instruction executed, with the address, op-code (data) and control 
signals visible. When the Diagnostic Emulator stops executing the target program, 
the following events take place: 

1. The processor stops executing the target program. 

2. The processor registers are saved in internal scratch pad memory and are 
accessible for display or alteration. 

The operator, in effect, freezes the target program execution at the point reached 
when STEP was depressed. The operator then has several options: 

1. Continue executing the program at full speed by pressing RUN. 

2. Continue executing the program one instruction at a time by pressing 
STEP for each additional instruction execution. 

3. Examine or change the contents of any of the processor registers. 

4. Examine any memory or I/O address, and if the location is writable, store 
new data in it. 

5. Review the last 252 bus cycles performed by the processor by 
decrementing through the Trace Memory. 

The state of the target program is not changed by any of these operations 
(except as purposely altered by the operator) and program execution may be 
continued from the point where it stopped. 

The program may be executed one instruction at a time by pressing STEP once 
for each instruction. If STEP is pressed and held down, the Diagnostic Emulator 
begins stepping at about seven instructions per second. The step rate then 
accelerates gradually from 7 steps per second to about 75 steps per second. 
Execution stops again if the keyswitch is released. 
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Table 4-1.1. Display Panel Indicators 



FAULT GROUP 

ILLUMINATES IF: 

CLK Target system clock not operating. 

Target system clock is low in frequency. 
EM- 180 not connected to target system. 

RESET Processor and Diagnostic Emulator held in Reset by a low on the 
RESET terminal of the microprocessor socket. 

MACHINE CYCLE GROUP 

ILLUMINATES IF: 

Ml Displayed machine cycle is the first op-code fetch cycle of an instruction. 

Ml' Displayed machine cycle is the second op-code fetch of an instruction. 

BKPT Breakpoint. Conditions set up for an output from the breakpoint 
circuitry were satisfied during the displayed machine cycle. 

EXT External. External Breakpoint input low (active) during displayed 
machine cycle. 

IORQ Input/Output Request. Machine cycle being displayed is a data transfer 
from an input port address or to an output port address. 

IACK Interrupt Acknowledge. Machine cycle being displayed is an interrupt 
acknowledge cycle. 

RD Read. Machine cycle being displayed is a read from memory or read 
from I/O cycle. 

WR Write. Machine cycle being displayed is a write to memory or write to 
I/O cycle. 
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FLAGS 

ILLUMINATES IF: 

S Sign bit is true. 

Z Zero bit is true. 

H Half-Carry bit is true. 

P/V Parity/Overflow bit is true. 

N Add/Subtract flag is true. 

C Carry bit is true. 

CPU STATUS 

ILLUMINATES IF: 

ENA Emulated processor is ready to respond to an interrupt. (Interrupts 
enabled) 

INT Interrupt. The interrupt input (pin 16) of the Z-80 is low (active) . 

NMI Non-Maskable Interrupt. The NMI input (pin 17) of the Z-80 is active. 

BUSR Bus Request. The BUSRQ input of the Z-80 is low (active). 

Wait Wait input (pin 24) of Z-80 is low. CPU is waiting. If the CPU is 

working with a system that requires some wait states, the indicator may 
be more or less dimly lit. 

Halt Processor has executed a HALT instruction and has entered the HALT 
state. 

Pause Real-time emulation of the target program is suspended and the 
Diagnostic Emulator is awaiting another command. 

BKPT 

ENA Breakpoint Enable. Illuminates if the RUN BKPT detect circuitry is 
armed. 
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4-1.4 Breakpoint System 



Table 4-1.2 Breakpoint Qualifiers 



The Diagnostic Emulator incorporates a Regional/Relational breakpoint 
generation system to enable the user to monitor the operation of his program 
and to stop execution of his program when desired. The EM- 180 contains two 
independent address comparators. Each of these comparators continuously 
monitors the 16-bit address bus of the microprocessor. In addition, each 
comparator may be qualified to respond to read cycles only, to write cycles only, 
or to both read and write cycles. The comparators may also be configured to 
respond to memory addresses or to I/O port addresses. 

It is also possible to configure the breakpoint system so that a specified 
relationship must hold between the A and B breakpoint comparators before 
PAUSE occurs. The relationships that may be specified are the following: 



1. AorB 



Break if condition A or condition B (or both) is found. 



2. A then B. Break if condition A is found followed some time later by 

condition B. 

3. A -*+-B Break if any address in the range from A to B (inclusive) is 

found. 

4. -«-A — B+- Break if any address outside of the range from A to B is 

found. (Including addresses A and B.) 



- Disable 

1 - Memory Read 

2 - Memory Write 

3 - Memory Read/Write 



4 - Not Used 

5 - I/O Read 

6 - I/O Write 

7 - I/O Read/Write 



C- AorB 

D - A then B 

E - Range A to B 

F - Range outside A to B 



The various breakpoint possibilities are set up by simple keystroke sequences. 
The breakpoint address and the breakpoint qualifiers may be changed 
independently of each other any time the emulator is in the pause mode. 



Some examples of these sequences follow. 



24 
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EXAMPLE: 

Set up breakpoint comparator A to respond to read or write cycles at address 
4300! 6 ; disable comparator B. 



KEYSTROKE SEQUENCE: 



aoooo 



Set breakpoint address. 



BKPT 
A 



BKPT 
B 



Q 



Set qualifier 3 (memory R/W) . 
Press and hold down BKPT A Key while qualifier is entered. 

Set qualifier (Disable) . 
Press and hold down BKPT B Key while qualifier is entered. 



On power up, the EM-180 sets the qualifiers for both breakpoint comparators for 
the A OR B relation (comparators operating independently of each other) and 
the memory read/write qualifier. The address to which each comparator is 
initialized is 0000 16 . In the preceding example it was not necessary to alter the 
relationship holding between the two comparators, so the default A OR B 
relationship was not altered. 

EXAMPLE: 

Set up breakpoint comparator A to respond to read cycles only at memory 
address 8A72 16 , and breakpoint comparator B to respond to write cycles to I/O 
port 13, 6 . 

KEYSTROKE SEQUENCE: 



QQQQI 

3m 



Set A breakpoint address. 



Set A qualifier to 1 (MEMORY read). 



BKPT 
B 



BKPT 
B 



Press and hold down BKPT A Key while qualifier is entered. 

: |l i J I 3 Set B breakpoint address. 

| 6 Set B qualifier to 6 (I/O WRITE) . 

Press and hold down BKPT B Key while qualifier is entered. 



B 
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When the breakpoint circuitry is set up as desired, program execution may be 
started using RUN BKFT. The function RUN BKFT is the same as the function 
of RUN except that when the breakpoint condition occurs, program execution 
stops (after finishing the instruction cycle). It is also permissible to start program 
execution using the RUN Key, and then later arm the breakpoint-stop circuitry 
by depressing RUN BKFT even while the target program is executing. 
Breakpoints may be disabled while the target program is executing by depressing 
RUN. The BKFT ENA indicator on the display shows the current breakpoint 
enable status of the emulator. 
EXAMPLE: 
Set up write-only breakpoint range from 4307 16 to FFFF 16 . 

KEYSTROKE SEQUENCE: 

Tj) * [[ 3 (_0_ [_7^ Set A to range beginning (4307, J. 



@Q 



Set qualifier to 3 (Memory R/W) and E (Range A to B) . 



Press and hold down BKPT A Key while qualifiers are entered. 



SQQQ 



Set B to range end (FFFF 16 ). 



In this example, two qualifiers were entered: one to specify that write cycle 
detection was desired and a second to specify that the A and B comparators are 
to work together to define a continuous range. With the specifications made as 
shown, the breakpoint circuitry will respond to any write cycle to any address in 
the range of 4307, 6 to FFFF 16 . Note that it was not necessary to specify any 
qualifiers for the B comparator; this is because the two comparators are linked 
together to provide address range detection and the qualifiers entered for A 
apply also to B. 
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Table 4-1.3. Breakpoint Combinations 



EXAMPLE: 

Set up sequential breakpoint detection such that target program execution will 
halt after the A comparator has detected memory address EB22 16 and then the 
B comparator has detected a write to I/O port 48, 6 . 



KEYSTROKE SEQUENCE: 



BKPT 
A 



=X/ (\ 

2 2 

—^f v i 



Set A to memory address EB22, 



90GJ 



Set A qualifiers to 1 (Memory Read) and D (A then B) . 

Press and hold down BKPT A Key while qualifiers are entered. 
( , * .(. ~ > > ( , > . 



Set B to port address 48, 6 . 



BKPT 
B 



Set B qualifier to 6 (I/O Write). 
Press and hold down BKPT B Key while qualifiers are entered. 



In this example, separate qualifiers were required for the A and B comparators 
because no restriction on the type of cycle is implied by the A then B relation as 
is the case with the RANGE qualifiers. 

Table 4.1.3 shows the permissible breakpoint combinations. 




DISABLE 

1 
MEM HI) 

2 
MEMWR 

3 
MEMR/W 



5 
I/ORD 

6 
I/OWR 

7 
I/O R/W 

"Breakpoints A and B will both be of same type, such as MEM RD or I/O R/W. Type may be 
specified for either A or B and will be in effect for both comparators. 



c 

AorB 


D 

A then B 


E 


F 
-*A-B+~ 


•^ 


*> 


^ 


^ 


c 


s 


' 


• 


y' 


IS 


' 


• 


^ 


^ 


• 


• 


Not Used 


Not Used 


Not Used 


Not Used 


u' 


c* 


• 


* 


lS 


J-* 


* 


• 


S 


(^ 


• 


• 
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4-1.5 TRACE MEMORY 



One of the most useful EM- 180 features is its 252 bus cycle Trace Memory. The 
Trace Memory is organized as a ring buffer that records all target program 
activity. It operates in both real-time and single-step modes, and its contents 
remain in the correct sequence, regardless of whether the user operates the 
program wholly or partly in either of these two modes. 

To review the Trace Memory contents, the EM- 180 must be paused. The 
PAUSE mode is entered automatically when the program encounters a 
breakpoint, or it can be entered manually by depressing STEP. When the 
program enters PAUSE as a consequence of depressing the STEP Key, the 
Display shows the fetch cycle address and data for the last instruction recorded. 

When a breakpoint event triggers PAUSE* , the Display shows the cycle where 
the breakpoint was detected, and the user can easily review the program 
activities leading up to the event. Depressing DEC allows the user to examine 
the last 252 bus cycles of program activity prior to the breakpoint. Depressing 
INC allows the user to review forward up to the last cycle traced. Depressing 
STEP advances the target program past the breakpoint event, one instruction at 
a time. Depressing TRACE allows the user to return to Trace Memory again 
after selecting another mode (i.e., MEM ADDR, I/O ADDR, etc.) and return 
the original program event or bus cycle to the display. The TRACE Key has no 
effect unless the program is already in PAUSE. STEP actually causes the 
emulator to execute another program instruction and this instruction is entered 
into the Trace Memory like all others. 

The Z-80 machine instructions may have one or several bus cycles per 
instruction. The following two examples illustrate displayed Trace Memory 
contents, first after executing a simple instruction and then after a more complex 
one. 



EXAMPLE 1 LD B, C 

Cycle Addr Data Fetch 



RD 



WR 



1 



4000 



41 



X 



Single bus cycle instruction: Move contents of C register to B register. Assume 
the instruction location is address 4000, 6 in the target memory. The Trace 
Memory records a bus cycle with the address of 4000 16 , data of 41 16 and 
control bits indicating that it is a fetch operation and a read cycle. 



'The EM- 180 finishes executing the instruction c\)c\e before it pauses. 
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CPU REGISTERS 



EXAMPLE 2 LD (07055H), HL 



Cycle 


Addr 


Data 


Fetch 


RD 


WF 


1 


4000 


22 


X 


X 




2 


4001 


55 




X 




3 


4002 


70 




X 




4 


7055 


34 






X 


5 


7056 


12 






X 



Five bus cycle instruction: Cycle one fetches op-code 22 of the LD instruction 
located at address 4000i 6 . Cycles two and three read low order and high order 
bytes (55 16 and 70, 6 ) of the 16-bit address located at 4001 16 and 4002 16 . Cycles 
four and five write the contents of the HL register pair (34 16 and 12 16 ). The 
Trace Memory records all five bus cycles of the instruction. The address location, 
program data and op-code cycle are shown on the Display Panel for each bus 
cycle of the instruction. If the EM-180 had entered PAUSE and displayed Cycle 
1 (the OP-CODE fetch), then the INC Key would be used to advance through 
the Trace Memory and observe the subsequent bus cycles. 

Normally, the INC and DEC Keys move the trace index one cycle at a time. If 
the operator depresses and holds down the TRACE Key, however, the INC and 
DEC Keys will cause the next or previous fetch cycle to be displayed without 
stopping on other machine cycles. 



The Z-80 register contents may be examined by the operator, and if desired, 
overwritten with new data. 

Register data is accessed for display by using the blue REG Keyswitch, followed 
by one of the hexadecimal keyswitches. This designates which register should be 
displayed. Table 4-2.1 shows the registers selected by the various keyswitches. 
Note that 4 through 7 do not correspond to actual Z-80 registers. These 
keyswitches are used to set up parameters for the Built-in test routines or User 
Code Functions. These Code Functions are described in later sections. (See 
Section 7 and Section 8) . 



AMC9113 5-H1 



29 




APPLIED 
MICROSYSTEMS 



Examples of readout and alteration of CPU registers: 
EXAMPLE: 



REG 



EEJIIQGj 



REG 



E 



B register contents displayed on address 

B register is accessed and then 
overwritten with data 3Fj 6 . 

Stack Pointer is accessed and displayed 
on 16-bit address display. 




QQQ 



HL Register Pair is accessed, and then 
the contents are overwritten with 
3C00 16 . 

The prime registers are accessed by depressing the hexadecimal key a second 
time. For example, the B-prime register is accessed in the following example: 

EXAMPLE: 



REG 



" l/U J 



The first key depression will access and display the B register, but depressing the 
key a second time switches the display to the prime register. If the B key is 
depressed yet again, the display goes back to the regular register again. 

All register contents are displayed on the Address Display. If the register has 16 
bits, then all four of the digits of the display will be illuminated. If the register has 
eight bits, then the value is shown on the two low-order digits of the Address 
Display. 



The Data Display is used for feedback to the operator of the register that has 
been selected. If the stack pointer is selected, the Data Display will show a T 
since the 1 digit key is used to select that register. If the B register is selected as 
in the example preceding, the Data Display will show a 'B'; if the B-prime 
register is selected, then a 'IB' will be displayed. 
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Table 4-2. 1 . Keyboard Designators 
(After REG Keyswitch 
is Pressed) 



4-3 EXAMINATION AND 

ALTERATION OF MEMORY 
LOCATIONS 





(first key push) 


(second key push) 


KEY 


REGISTER 


REGISTER DESCRIPTION 





PC 


Prog-am Counter 


1 


SP 


Stack Pointer 


2 


HI. 


HL' HL Register Pair and Prime 


3 


DE 


DE' DE Register Pair and Prime 


4 


BEG* 


Begin Address (for programmed tests) 


5 


END* 


End Address (for programmed test) 


6 


ADDR* 


Address (programmed test parameter) 


7 


DATA* 


Data (programmed test parameter) 


8 


IX 


K Register 


9 


IY 


IY Register 


A 


A 


A' Accumulator and Prime 


B 


B 


B' B Register and Prime 


C 


C 


C C Register and Prime 


D 


D 


D' D Regfeter and Prime 


E 


E 


E' • E Register and Prime 


F 


FLAGS 


FLAGS' Flags and Prime 



* Not an actual Z-80 register. 



Any memory location accessible to the emulated microprocessor may be 
accessed and displayed by the EM-180. If desired, new data may be written to 
the location. 

EXAMPLE: 



MEM 
ADDR 



43 ! A I™" Address 431 A 16 is entered, and when 
i, it^j, v=^ »i=y it=J/ %=)> EXAM js pressed fa, EM . 180 wi „ read 

from address 431A 16 and display the 
data obtained. 



If the operator wishes to review a group of sequential memory locations, this 
may be done by entering the initial address and examining that location as 
above; then examine successive locations by depressing INC. 

EXAMPLE: 



©G30O0 

3 



EXAM 



etc. 



Examine data at 4300, 6 . 
Examine data at 4301 16 



Examine data at successive locations, 
etc. 



A memory location may be altered by entering an address, as shown above, 



AMC9113 5 81 



31 




AIMMJKI) 

MICROSYSTEMS' 



then entering data using LOAD DATA and finally storing the data to the 
selected memory address using STORE. 

EXAMPLE: 



@QQQQ@QQ 



.• 


1 — 1 

STORE 

J 1 



The above sequence writes the data 55i 6 to memory address 13FE 16 in the 
target system. 

Sequential locations may be quickly altered by incrementing the address after 
each data entry operation. For example, the following keystroke sequence enters 
a short program fragment into memory: 

EXAMPLE: 



H30OGD 



(I *lA fr«f X 

LOAD C 3 

DATA ^ J 

*--— -^ Vt J/ Vt -U 

300 



INC 



Enter initial address 0800, 6 



Enter data C3, 6 then store the data to 
0800 l6 and increment to 0801,«. 

Enter data 00, 6 then store the data to 
0801 16 and increment to 0802, 6 . 

Enter data 08 16 and store to 0802, 6 ; 
increment to 0803 16 , etc. 



The EM-180 does not require redundant keystrokes. The unit assumes that if 
the operator has entered new data while a particular memory address is 
accessed, then the operator wants to store that data before going to the next 
address. 

In all of the above examples in which INC was used, DEC (decrement) could 
also have been used. 
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I/O PORTS 



Input/Output ports of the Z-80 may be accessed and displayed in a similar 
manner to that described for memory addresses, with two differences. The first is 
that the I/O ports respond to an eight-bit address and consequently only eight- 
bit addresses need be entered. The second difference is that the INC and DEC 
keyswitches do not perform an automatic read of the next (or previous) I/O port 
address. The intent of this characteristic is to help the operator avoid unintended 
reading of an I/O port, since this sometimes results in a change of state of 
complex I/O devices. For example, a complex interface circuit such as the Zilog 
PIO will change state when the input data register is read. The following is a 
keystroke sequence that may be used to examine data at an input port: 



EXAMPLE: 



@QGjg 



Read and display data at Input Port 3. 



fd rn im ira 



STORE 



Data A0 16 is written to Output Port 
1B I6 . (No READ cycle was 
performed at Port IB.) 
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5-1 OVERVIEW 



5-2 CONTROLS 



figure 5-2.1. RAM Overlay Controls. 



The EM- 180 may be configured with an optional RAM Overlay feature. The 
RAM Overlay consists of a circuit board with 8K bytes of 200 nSEC static 
memory along with appropriate addressing and control logic. 

The 8K bytes of memory is divided into two independent 4K byte blocks. Each 
block has independent addressing and control circuitry and may be enabled as 
read-write memory, as read-only memory or disabled. Controls for the two 
memory blocks are located on the back panel of the Operator's Station. 

If the RAM Overlay is set up to respond to a range of addresses, say 0000,6 to 
0FFFi 6 , then target system memory in the same address range becomes 
inaccessible to the emulation processor. The memory block has"overlayed" the 
corresponding target system addresses. (See, however, the description of Code 
Function C5 for an exception to this characteristic of the EM-180.) 

The contents of the RAM Overlay is retained as long as power is applied to the 
EM-180. It is possible to load the RAM Overlay with data, then switch the 
enable switches to the OFF Position, then at some later time, switch the enable 
switches to READ or RD/WR and use the data. , 



Each 4K byte block of memory has an associated Address Range switch and 
Enable switch. See Figure 5-2.1. 







The Enable switches are three-position toggle switches that place the memory 
bank into one of three conditions: 

1. Off 

The memory bank is disabled and is effectively removed from the system. 
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Table 5-2. 1 . Memory Block _, 

Address— A and B 



2. Read 

The memory bank is placed in a Read-Only configuration so that from the 
point of view of the target system the memory bank behaves like Read- 
Only-Memory. In this mode, it is not possible for the target system program 
to alter the contents of the memory. Note, however, that the EM- 180 is still 
able to write to the memory bank from the Keyboard or from a Code 
Function routine such as Code Function C3 (download) . 

3. Read/Write 

The memory bank is placed in a Read/Write configuration. Both the target 
system and the EM- 180 are able to read the memory and write new information 
to it. 

If a memory bank is disabled (toggle switch in the OFF position), the memory 
will nevertheless continue to retain data. The data will reappear in the target 
address space whenever the memory is again enabled. 

The Address Range switches are 16-position rotary switches used to select the 
address range where the 4K memory blocks will reside in the target address 
space. Each of the 4K memory blocks can be moved to any of 16 positions, 
beginning at a 4K boundary. See Table 5-2.1. 



SWITCH 
POSITION 



MEMORY BLOCK 
ADDRESS 



SWITCH 
POSITION 



MEMORY BLOCK 
ADDRESS 






0000 16 - 0FFF 16 


8 


8000 16 - 8FFF 16 


1 


1000 16 - 1FFF 16 


9 


9000, 6 - 9FFF 16 


2 


2000 16 - 2FFF 16 


A 


A000, 6 - AFFF 16 


3 


3000 16 - 3FFF 16 


B 


B000 16 - BFFF 16 


4 


4000 16 - 4FFF l6 


C 


C000 16 - CFFF 16 


5 


5000 16 - 5FFF 16 


D 


D000 16 - DFFF 16 


6 


6000 16 - 6FFF 16 


E 


E000 16 - EFFF 16 


7 


7000 16 - 7FFF 16 


F 


F000 16 - FFFF l6 
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6-1 OVERVIEW 



6-1.1 



OPERATION 

PREPARATION 

PROCEDURES 



The EM- 180 Diagnostic Emulator may be configured with an enhanced firmware 
package that includes a disassembler. The disassembler firmware gives the 
EM- 180 the ability to output the contents of the Trace Memory and emulation 
processor registers to the serial port; in this way a readable and attractive display 
may be created on a CRT or hardcopy terminal. 

The disassembly firmware is disabled when the EM- 180 is first powered up and 
must be enabled before use. The following procedure will make the EM- 180 
ready to operate with an ASCII terminal and disassembly firmware: 

1. Connect the terminal to the EM- 180 using an appropriate cable. The 
minimum circuits that must be connected are: 

Pin 1 - Protective Ground 

Pin 2 - Serial Data Out 

Pin 7 - Signal Ground 

Some RS-232 terminals may also require the following connection: 

Pin 20 - Data Terminal Ready 

Take care that Pins 10, 11, 12, 13, 22, 23, 24 and 25 are not connected 
to incompatible circuits. See 9-1, Auxiliary Connector. 

2. Set the Baud Rate Selector switches of the EM- 180 and the terminal to 
compatible settings. 

3. Check the setting of Option Switch 3. If Option Switch 3 is open (up), then 
the EM- 180 will not output serial data unless the Clear-to-Send signal (Pin 
5) is high. If the Clear-to-Send signal is not important in your application, set 
Option Switch 3 to the CLOSED (down) position and the EM- 180 will 
output data on command regardless of the state of Pin 5. 

4. Enable the disassembly firmware by executing the Code Function El, E2 or 
E3. The EM-180 is now ready to output to the terminal device. See Table 
6-1 for format selection information. 

The disassembly firmware may be turned off by executing Code Function E0. 

Operate the EM-180 in the normal manner. Any time that the EM-180 
transfers from RUN to PAUSE, the disassembly firmware will format and dump 
a part of the contents of the Trace Memory to the terminal; normally 24 lines 
of output are produced. The last line output represents the last instruction 
executed and the firmware will then output the register display. 
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table 6-1. Disassembly Format 
Selection 



6-2 FORMAT DEFINITION 



If the EM- 180 is operated in single-step mode, the firmware will output the 
register display after every instruction. 

The disassembly software is designed so that 20 lines of output are produced 
each time the emulator transfers from RUN to PAUSE; this amount of data 
provides approximately a fuD screen On most CRT terminals. If output of the 
entire contents of the Trace Memory is desired, execute Code Function D8. This 
Code Function will execute even if disassembly is not enabled, but the 
disassembly firmware option must be installed on the machine. All of the data in 
the Trace Memory will be formatted and output. Data output may be suspended 
for a moment by depressing the EXAM Key; when the Key is released, data 
output will continue. 

NOTE: It is possible that the data recorded in Trace Memory does not represent 
actual machine execution of a program (for example, a block of data left by a 
memory diagnostic Code Function or a data transfer Code Function). In such a 
case, the disassembler will not format and output the data. 



CODE 
FUNCTION 



REGISTERS DISPLAYED 



FORMAT 



E0 




{Disable Disassembly) 


El 


Flags, A, BC, DE, HL, SP 


80-Character Line 


E2 


Flags, A, BC, DE, HL 


72Character Line 


E3 


Flags, A, BC, DE, HL, K 

IY, SP, Flags', A', BC, DE', HL' 


Two 72-Character Lines 



Figures 6-2.1, 6-2.2, and 6-2.3 show some lines from a printer connected to an 
EM-180. The various fields of the disassembly presentation are identified in the 
figure. All numbers that are output by the disassembler are in hexadecimal 
representation. Additional information about the fields of the display follows: 

Address 

The address of the first op-code byte of the instruction. 

Op-Code 

The operation code of the instruction. Double op-code instructions are displayed 
with the prefix byte extending to the left of the column of op-code bytes. The 
two-line register display format will show the IX register contents underneath this 
field. 

Operand 

The operand bytes of the instruction (if any) . 



AMC 9113 9-81 



41 




APPLIED 
MICROSYSTEMS' 




Op-Code Mnemonic 

The operation code of the instruction given in mnemonic form. The two-line 
register display format will show the IY register contents underneath this field. 

Operand 

The operand field of the instruction is symbolic format, except that addresses 
and constants are given as hexadecimal numbers. 

Data Transfer 

Any data transfer operations that occur as a consequence of the instruction are 
shown here. The most common formats are: 

AAAA>DD 

orAAAA<DD 

The first format means that the processor wrote data 'DD' to address 'AAAA'. 
The second format means that the processor read data 'DD' from address 
'AAAA'. The other formats are associated with I/O instructions and take the 
form: 

-PP>DD 

-PP<DD 

The first of these formats means that the processor wrote data 'DD' to output 
port 'PP. The second format means that the processor read data 'DD' from 
input port 'PP. The two-line register display format will show the stack pointer 
contents underneath this field. 

Data Transfer 

Some instructions transfer more than one byte of data. The second byte of a 
data transfer will be shown in this field. If there are more than two bytes 
transferred, the additional bytes are shown in fields 6 and 7 on the following 
line. See, for example, the EX (SP), HL instruction which reads two bytes from 
the top of stack and then writes two other bytes to the top of stack. All of these 
transfers are easily seen from the display. 

Breakpoint 

If a breakpoint occurred during the execution of the instruction on this line, it will 
be identified in this column by an asterisk ( * ). 
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Flag Register 

The CPU flag register (condition code register) is shown in this field. Each of the 
five characters in this field represent one of the condition code bits as follows: 

First - 'S' if sign bit is true. 

Second - 'Z' if zero bit is true. 

Third - 'H' if half carry bit is true. 

Fourth - V if parity/overflow bit is true. 

Fifth - 'N' if subtract flag bit is true. 

Sixth - 'C if carry bit is true. 

If any of the condition code bits are not true, the letter is replaced by a period. 
The two-line register display format will show the alternate (prime) flag register 
underneath this field. 

Accumulator 

The content of the accumulator after the execution of the instruction. The two- 
line register display format will show the alternate (prime) accumulator 
underneath this field. 

BC Register Pair 

The content of the BC register pair following the execution of the instruction. 
The two-line register display format will show the alternate (prime) BC register 
pair underneath this field. 

DE Register Pair 

The content of the DE register pair following the execution of the instruction. 
The two-line register display format will show the alternate (prime) DE register 
pair underneath this field. 

HL Register Pair 

The content of the HL register pair following the execution of the instruction. 
The two-line register display format will show the alternate HL register pair 
underneath this field. 

Stack Pointer 

The content of the stack pointer following the execution of the instruction. This 
field is not displayed in the 72-character line formats. 
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Figure 6-2. 1 Code El 80-Character 
Single-Line 
Disassemb/y Format 











«r 




•* •* £ 




// 

C3 2B00 


'J 


/ 
002B 


/ 


t * i i i / i i 


0000 


JP 






002B 


31 


E030 


LD 


SP»30E0 






002E 


18 


03 


JR 


0033 






0033 


2A 


B130 


LD 


HL»(30B1) 


30BK23 


30B2<9D 


0036 


18 


OC 


JR 


0044 






0044 


11 


DD62 


LD 


DE»62DD 






0047 


19 




ADD 


HLiDE 






0048 


7C 




LD 


ArH 






0049 


B5 




OR 


L 






004A 


20 


08 


JR 


NZ»0054 






004C 


3A 


8034 


LD 


A. (3480) 


3480<FF 




004F 


E6 


40 


AND 


40 






0051 


C2 


0D01 


JP 


NZrOlOD 






010D 


DF 




RST 


18 


30DF>01 


30DE>0E 


0018 


C3 


100E 


JP 


0E10 






0E10 


E3 




EX 


(SP)rHL 


30DE<67 
30DF>00 


30DF<01 
30DE>00 


0E11 


D5 




PUSH 


DE 


30DD>62 


30DODD 


0E12 


F5 




PUSH 


AF 


30DB>40 


30DA>10 


0E13 


33 




INC 


SP 






0E14 


EB 




EX 


DErHL 






0E15 


3E 


CB 


LD 


A.CB 






0E17 


32 


7430 


LD 


(3074)»A 


3074>CB 




0E1A 


1A 




LD 


A»(DE) 


0167<3E 




0E1B 


32 


7530 


LD 


(3075)»A 


3075>3E 




0E1E 


3E 


C9 


LD 


A»C9 






0E20 


32 


7630 


LD 


(3076) »A 


3076>C9 




0E23 


13 




INC 


DE 






0E24 


21 


9F30 


LD 


HL»309F 






0E27 


CD 


7430 


CALL 


3074 


30DA>0E 


30D9>2A 


3074 


CBFE 




SET 


7»(HL) 


309F<C0 


309F>C0 


3076 


C9 




RET 




30D9<05 


30DA<70 


7005 


FF 




RST 


38 


7006<FF 


30DA>70*. .H.. . C9 003D 0168 309F 30DB 
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Figure 6-2.2 



Code E2 72-Character 
Single-Line 
Disassemfc/y Format 





C3 


' J 

/ 


/ 

d* «/ 

JP 002B 




■* £ £ 
-v 4* 4* 

/ / / / / / 

<f / a & $ 


0000 


2B00 






002B 


31 


E030 


LD 


SP»30E0 






002E 


18 


03 


JR 


0033 






0033 


2A 


B130 


LD 


HL»<30B1) 


30BK23 30B2<9D 




0036 


18 


OC 


JR 


0044 






0044 


11 


D062 


LD 


DE»62DD 






0047 


19 




ADD 


HL,DE 






0048 


7C 




LD 


AiH 






0049 


E5 




OR 


L 






004A 


20 


08 


JR 


MZi0054 






004C 


3A 


8034 


LD 


A»(3480) 


3480<FF 




004F 


E6 


40 


AND 


40 






0051 


C2 


0D01 


JP 


NZ»010D 






010D 


DF 




RST 


18 


30DF>01 30DE>0E 




0018 


C3 


100E 


JP 


0E10 






0E10 


E3 




EX 


<SP)»HL 


30DE<67 30DF<01 
30DF>00 30DE>00 




0E11 


D5 




PUSH 


DE 


30DD>62 30DODD 




0E12 


F5 




PUSH 


AF 


30DB>40 30DA>10 




0E13 


33 




INC 


SP 






0E14 


EB 




EX 


DEfHL 






0E15 


3E 


CB 


LD 


AtCB 






0E17 


32 


7430 


LD 


(3074)»A 


3074>CB 




0E1A 


1A 




LD 


Ar(DE) 


0167<3E 




0E1B 


32 


7530 


LD 


(3075) f A 


3075>3E 




0E1E 


3E 


C9 


LD 


A»C9 






0E20 


32 


7630 


LD 


(3076) f A 


3076>C9 




0E23 


13 




INC 


DE 






0E24 


21 


9F30 


LD 


HL»309F 






0E27 


CD 


7430 


CALL 


3074 


30DA>0E 30D9>2A 




3074 


CBFE 




SET 


7»(HL) 


309F<E0 309F>E0 




3076 


C9 




RET 




30D9<05 30DA<70 




7005 


FF 




RST 


38 


7006<FF 30DA>70*,« 


H... C9 003D 0168 309F 
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Figure 6-2.3 



Code E3 72-Character 
Two-Line 
Disassembly Format 



/ 


6F 


s9 *r ^ 

7/ 


ft 

ft? 

Lr A 


JF^ 4*-^ **•$• 

4* s £p £$> *f *** *<? 

</ J / «t it ft ff a 

*i j ffy j ■ # ^c $& && 


07E4 




LD 




07E5 


7C 




LD 


A»H 




07E6 


CE 


00 


ADC 


A»00 




07E8 


27 




DAA 






07E9 


67 




LD 


HrA 




07EA 


3A 


7534 


LD 


A»(3475) 


3475<4E 


07ED 


E6 


08 


AND 


08 




07EF 


C9 




RET 




305A<BB 305B<07 


07BB 


C2 


B807 


JP 


NZ,07B8 




07B8 


CD 


D007 


CALL 


07D0 


305B>07 305A>BB 


07D0 


3D 




DEC 


A 




07D1 


78 




LD 


A. B 




07D2 


A7 




AND 


A 




07D3 


CA 


F007 


JP 


Z»07FO 




07D6 


3A 


7E30 


LD 


A» (307E) 


307E<57 


07D9 


83 




ADD 


A»E 




07DA 


5F 




LD 


E»A 




07DB 


3A 


7F30 


LD 


A, (307F) 


307F<4E 


07DE 


8A 




ADC 


A,D 




07DF 


57 




LD 


D»A 




07E0 


7D 




LD 


AfL 




07E1 


CE 


00 


ADC 


A, 00 




07E3 


27 




DAA 






07E4 


6F 




LD 


LrA 


16 1B00 7D11 2416 




ix; 


3000 


IYJOOOO 
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7-1 Group A: Memory Tests 

7-2 Group B: Oscilloscope Loops 

7-3 Group C: Memory Load and Dump 

7-4 Group D: Miscellaneous 

7-5 Group E: Change Default Parameters 

7-6 Group F: Internal Operations 
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7-1 GROUP A: 

MEMORY TESTS 



The Diagnostic Emulator contains Built-in test functions and utility routines 
designed to be convenient and useful for testing systems and verifying their 
proper operation. These test and utility routines have been named Code 
Functions because they are accessed by depressing the CODE keyswitch, 
foflowed by hexadecimal digits designating the routine desired. Table 7-1 lists all 
of the Code Functions programmed into the Diagnostic Emulator. 



CODE Al -OO/FF DATA TEST 

The Code Function Al memory test routine quickly determines whether all 
locations within a specified range can be set to 00, 6 and FF, 6 . The range tested 
is from the address specified by the BEG (begin) register through the address 
specified by the END register. The routine operates by setting the first location of 
the range to 00, 6 and reading the location to see if a 00 16 is returned. Then the 
routine stores an FF 16 to this location and reads the location to see if an FFi 6 is 
returned. Finally, the routine increments the address and tests the next location 
in the range. During the execution of this test, the address and data activity are 
visible on the displays and stored in the Trace Memory. 

If a memory error is encountered, the routine emits 3 beeps and displays the 
address of the failure and the erroneous data read. At this rime the operator has 
three options: 

1. Depress EXAM to display the data the routine expected to read from the 
memory. Release the keyswitch to again display the bad data. 

2. Depress INC to continue testing at the next address in the range. If 
additional problems are found, the program will stop again and any of the 
options listed may be taken. 

3. Exit the test routine by using any of the mode keys (MEM, I/O, REG, 
RUN, etc.) or RESET. 

After testing all locations in the specified range, the EM-180 emits one short 
beep and repeats the test. The RESET keyswitch is used to terminate the test at 
any time. 
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Tdbte 7-1. Code Functions 



GROUP A: MEMORY TESTS 



Al 
A2 
A3 
A4 

A5 
A6 
A7 
A8 



GROUP B: OSCILLOSCOPE LOOPS 



RAM TEST 


(00/FF) 1 




RAM TEST 


(Rotating Is) 1 


Repeating Tests 


RAM TEST 


(Addresses) | 




ALL RAM TESTS 


J 




ALL RAM TESTS 


1 




RAM TEST 


(00/FF) j 




RAM TEST 


(Rotating l's) [ 


One Pass and Stop 


RAM TEST 


(Addresses) i 





Bl 
B2 
B3 
B4 
B5 
B6 
B7 

B9 
BC 
BD 
BE 
BF 



Repetitive Memory Read 

Repetitive Memory Write 

Repetitive I/O Read 

Repetitive I/O Write 

Continuous Address Increment, 64K Range 

Repetitive Memory Write ( Data /Panel PROM) 

Repetitive I/O Write (Data/Data) 

Continuous Address Increment with Adjustable Range 
Repetitive Store/Examine Memory 
Repetitive Store/Examine I/O Port 
Store Rotating 1-Bit to Memory 
Store Rotating 1-Bit to I/O Port 



GROUP C: MEMORY LOAD AND DUMP 



CI 
C2 
C3 
C4 
C5 
C6 
C7 
C8 
C9 
CB 
CC 
CE 



Load Target from Front Panel PROM 

Verify Target with Front Panel PROM 

Load Target from Serial Link (DOWNLOAD) 

Dump Target to Serial Link (UPLOAD) 

Load RAM Overlay from Target 

Verify Ram Overlay with Target 

Verify Target Against Serial Link 

Fill Target with Specified Data 

Verify Target with Specified Data 

Block Move Target System Data 

Dump Target to Serial Link in User Viewable Format 

Repeat Segment of Data Over an Entire Block 
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GROUP D: MISCELLANEOUS 



DO 
Dl 
D2 
D3 
D4 
D5 
D6 
D7 
D8 
D9 
DA 
DB 
DC 
DD 
DE 
DF 



Clear Interrupt Enable Flip-Flop 

Set Interrupt Enable Flip-Flop 

Display Clock Frequency 

Display PROM/ROM Signature 

Output 50 Nulls torn Serial Link 

Call User Routine in Internal RAM at 3000 I6 

Call User Routing in Internal RAM at 3003 16 

Clear Trace Memory 

Dump Entire Content of Trace Memory 

Halt CPU (for changing Front Panel PROM) 

Display Revision Number for Control PROM 

Display Revision Number for Disassembly PROM 

Calculate Branch Offset and Display 

Do Self-Test of Control PROM and Disassembly PROM 

Output (CR)(LF)(NUL)(NUL) from Serial Link 

Count Hours, Minutes and Seconds on Display 



GROUP E: CHANGE DEFAULT PARAMETERS 



E0 
El 
E2 
E3 



Disable Disassembly (Default at Power On) 
Enable Disassembly, 80 Character Line, One Line of Registers 
Enable Disassembly, 72 Character Line, One Line of Registers 
Enable Disassembly, 72 Character Lines, Two Lines of Registers 
(IX, IY, SP and Prime registers on Line 2) 



GROUP F: INTROSPECTION MODE 



F 
F0 

through 
F9 



Set Basic"In1rospecfion" Mode 

Set Introspection Mode and Initialize Emulator for Debug of 
User Code Function Program 



CODE A2-ROTATE l's 

Code Function A2 memory test routine performs a test on all data bits in the 
range specified. The range tested is from the address contained in the BEG 
register through the address contained in the END register. The routine starts 
with the first location in the range and tests the location by writing and checking 
a bit, one bit at a time, in all of the positions of the word under test. The routine 
writes and checks by writing and reading the following data patterns: 



Binary Pattern 

00000001 

00000010 

10 

00001000 

00010000 

00100000 

10 

10000000 



Hexadecimal 

oi 16 

02 16 
04 16 
08 16 
10 16 
20 16 
40 16 
80 16 
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After a location has been tested it is known that all bit positions in the location 
may be set and cleared independently of each other. The program then 
increments to the next sequential address in the range and proceeds to test in 
the same manner. If an error is detected, the test stops, the EM-180 emits the 
three beeps that signify an error, and the Display Panel shows the defective 
memory address and the bad data. At this point the operator has three options: 

1. Depress EXAM to display the data the diagnostic routine expected to read 
(good data). Release EXAM to return the bad data to the display. 

2. Depress INC to continue testing. If additional problems are found, the test 
stops and any of the options listed may be taken again. 

3. To terminate the test, depress RESET, RUN, or any of the mode select 
keyswitches. 

After testing all locations in the specified range, the EM-180 emits one short 
beep and repeats the test. The RESET keyswitch is used to terminate the test at 
any time. 

CODE A3- ADDRESS TEST 

Code Function A3 memory test determines whether an address decoding failure 
exists in the memory system under test. It tests the memory range from the 
address contained in the BEG register to the address contained in the END 
register. The routine prepares for operation by clearing all locations in the range 
to 00 16 . Next, the first location is set to FF 16 and then a check is made of all 
address-related locations in the range to determine if any of them have been 
altered by the writing of the FF 16 . After all locations in the range that are 
address-related to the first location have been checked, the program resets the 
first location to 00! 6 . Then the next sequential location in the range is set to 
FFis, and the address-related locations checked. The test proceeds until all 
locations in the specified range have been set to FF 16 , and the respective 
address-related locations checked. 

For the purposes of this test, an address is said to be related to a second address 
if it differs from it by only one bit (in any bit position). The test checks all possible 
address-related combinations as long as a generated address does not fall outside 
the specified range. 

If an addressing error is found the test stops, the EM-180 emits three beeps 
signifying an error, and the display shows the erroneous data and its address. At 
this point the operator has three options: 

1. Depress EXAM to display the data the diagnostic routine expected to read. 
Release EXAM to return the erroneous data back to display. 
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2. Depress INC to continue testing. If additional problems are found, the test 
will stop and any of the options listed may be taken again. 

3. To terminate the test depress RESET, or RUN or any of the mode selection 
keyswitches. 

After all locations in the specified range have been tested, the EM- 180 emits one 
short beep and repeats the test. To exit this code function at any time, depress 
RESET. 

CODE A4-ALL TESTS AND REPEAT 

Code Function A4 executes the Al, A2, and A3 diagnostic functions in 
sequence, then emits a short beep and repeats. The test may be terminated by 
depressing RESET. In the event that an enor is found, the operator may 
respond in any of the ways described for the individual diagnostic functions. 

CODE A5-ALL TESTS AND STOP 

Code Function A5 executes the Al, A2, and A3 diagnostic functions in 
sequence, emits a short beep and stops. In the event an error is found, the 
operator may respond in any of the ways described for the individual diagnostic 
functions. When the test is complete, the displays will read CODE A5 and the 
Trace Memory will contain a record of the last 252 bus transfers. 

CODE A6-00 FF DATA TEST 

Code Function A6 is identical to the Code Function Al except the function 
stops after a single pass through the test. When the test is complete, the displays 
will read CODE A6 and the Trace Memory will contain a record of the last 252 
bus transfers. 

CODE A7- ROTATE l's 

Code Function A7 is identical to the Code Function A2 except that the function 
stops after a single pass through the test. When the test is complete, the displays 
will read CODE A7 and the Trace Memory will contain a record of the last 252 
bus transfers. 

CODE A8- ADDRESS TEST 

Code Function A8 is identical to the Code Function A3 except the function 
stops after a single pass through the test. When the test is complete, the displays 
will read CODE A8 and the Trace Memory will contain a record of the last 252 
bus transfers. 
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7-2 GROUP B: 

OSCILLOSCOPE LOOPS 



The Oscilloscope Loop Functions are a group of functions that provide several 
types of repetitive stimuli to a target system. They provide repetitive waveforms 
in the target system hardware that may easily be examined at various circuit 
points with an oscilloscope or other test equipment. Many of the functions are 
also useful as stimulus routines for Signature Analysis testing. 
NOTE: ADDR register referred to below is "Hex Keyswitch - #6." 

CODE Bl -REPETITIVE MEMORY READ 

This function repetitively reads the single memory location addressed by the 
ADDR register. These address, data and RD signals are all shown on the 
Display. A high-going pulse is output from the BKPT A pin (pin 12) of the 
Auxiliary Connector each time the memory location is read. Depress RESET to 
exit this function. 

CODE B2-REPETITIVE MEMORY WRITE 

This function repetitively writes the data contained in the DATA register to the 
single memory location addressed by the ADDR register. These address, data 
and WR signals are all shown on the Display. A high-going pulse is output from 
the BKPT A pin (pin 12) of the Auxiliary Connector each time the memory 
location is written. Depress RESET to exit this function. 

CODE B3-REPETITIVE I/O READ 

This function repetitively reads the single I/O port location addressed by the 
ADDR register. The address, data and RD signals are all shown on the 
display. A high-going pulse is oulput from the BKPT A pin (pin 12) of the 
Auxiliary Connector each time the I/O port is read. Depress RESET to exit this 
function. 

CODE B4-REPETITIVE I/O WRITE 

This function repetitively writes the data contained in the DATA register to the 
I/O location addressed by the ADDR register. These address, data and WR 
signals are all shown on the Display. A high-going pulse is output from the 
BKPT A pin (pin 12) of the Auxiliary Connector each time the I/O port is 
written. Depress RESET to exit this function. 

CODE B5- CONTINUOUS ADDRESS INCREMENT 

This function places the EM- 180 in a special mode in which it outputs successive 
addresses from 0000, 6 to FFFF 16 at a very high rate. Internal to the EM- 180 this 
is accomplished by forcing a NOP instruction to the processor on every fetch 
cycle. Externally the EM- 180 appears to be doing a fetch cycle at each address 
at the full speed of the processor (as determined by the clock frequency) . 

In this mode, the processor does not respond to target system WAIT 
commands. 
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The Continuous Address Increment function is used to check out address 
decoding networks in hardware systems and as a stimulus for signature analysis 
trouble-shooting. 

It is possible to obtain a sync pulse for triggering an oscilloscope or a signature 
analyzer from either the Breakpoint A or Breakpoint B output at the back Panel 
Auxiliary Connector; the output pulse occurs each time the processor reads from 
the breakpoint address. (The processor does not stop.) 

Depress RESET to terminate the Continuous Address Increment mode. 



CODE B6 - REPETITIVE MEMORY WRITE (DATA/ DATA) 

This function repetitively writes data to the address designated by the ADDR 
register. The data written is that contained in the DATA register except it is 
complemented every other time data is written. The address, data and WR 
signals are all displayed. A high-going pulse is output from the BKPT A pin (pin 
12) of the Auxiliary Connector each time the address is accessed. Depress 
RESET to exit this function. 



CODE B7-REPETITIVE I/O WRITE (DATA/DATA) 

This function repetitively writes data to the I/O port designated by the ADDR 
register. The data written is that contained in the DATA register except it is 
complemented every other time data is written. The address, data, I/O and WR 
signals all are displayed. A high-going pulse is output from the BKPT A pin (pin 
12) of the Auxiliary Connector each time the I/O port is written. Depress 
RESET to exit this function. 



CODE B9- CONTINUOUS ADDRESS INCREMENT OVER 
ADJUSTABLE RANGE 

This function places the EM- 180 in a special mode in which it outputs successive 
addresses from a user-selected Begin Address to a user-selected End Address at 
a very high rate. The address increment range is from the address contained in 
the BEG register through the address contained in the END register. A high- 
going pulse is output from the BKPT A pin (pin 12) of the Auxiliary Connector 
each time the first address of the range is output; a high-going pulse is output 
from the BKPT B pin (pin 13) of the Auxiliary Connector each time the last 
address of the range is output. 

The output pulses are useful for oscilloscope or signature analyzer triggering. 
Depress RESET to terminate the Continuous Address Increment mode. 
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7-3 GROUP C: MEMORY 
LOAD AND DUMP 



CODE BC -REPETITIVE MEMORY WRITE/READ 

This Code Function writes the data contained in the DATA register to the 
address specified by the ADDR register, then reads the same address; this 
process is repeated at a high rate. A high-going pulse is output from the BKPT 
A pin (pin 12) of the Auxiliary Connector each time the memory address is 
accessed for either the write cycle or the read cycle. Depress RESET to exit this 
function. 

CODE BO-REPETITIVE I/O WRITE/READ 

This function writes the data contained in the DATA register to the I/O port 
specified in the ADDR register, then reads the same port address; this process is 
repeated at a high rate. A high-going pulse is output from the BKPT A pin (pin 
12) of the Auxiliary Connector each time the I/O port is accessed for either the 
write cycle or the read cycle. Depress RESET to exit this function. 

CODE BE-WRITE ROTATING BITS TO MEMORY 

This function repetitively writes a rotating bit pattern to the memory location 
selected by the ADDR register. The data contained in the DATA register is 
written to the memory location. Then each bit in the DATA register is shifted left 
one bit position each lime the memory location is written to. When tine bit shifts 
out of the high-order position, it is re-entered in the low-order position. A high- 
going pulse is output from the BKPT A pin (pin 12) of the Auxiliary Connector 
each time the memory address is written. Depress RESET to exit this function. 

CODE BF-WRJTING ROTATING BITS TO I/O PORT 

This function repetitively writes a rotating bit pattern to the I/O port selected by 
the ADDR register. The data contained in the DATA register is written to the 
I/O port. Then each bit in the DATA register is shifted left one bit position each 
time the port is written to. When the bit shifts out of the high-order position, it is 
re-entered in the low-order position. A high-going pulse is output from the 
BKPT A pin (pin 12) of the Auxiliary Connector each time the I/O port is 
written. Depress RESET to exit this function. 



The Code Function CI transfers data from the Front Panel Diagnostic PROM to 
the target system. This routine requires the user to specify the destination address 
range in. the target system by entering the first address of the range in register 
BEG and the last address of the range in register END. To use this Code 
Function, first enter the appropriate address values in the BEG and END 
registers, then start the routine. The routine will transfer bytes from the Front 
Panel PROM into the target address space with the first location in the PROM 
transferred to the first address of the specified range. After the transfer is 
complete, the Trace Memory contains a record of the last 252 cycles of 
the transfer. 
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CODE C2- VERIFY TARGET WITH FRONT PANEL PROM 

The Code Function C2 compares the Front Panel PROM with the address range 
specified by the user. The address range should be specified using the BEG and 
END registers in the same manner as described for CI. 

CODE C3-LOAD TARGET FROM SERIAL LINK (DOWNLOAD) 

The Code Function C3 transfers hex data from the serial RS-232C input to the 
target system. The data to be entered must first be converted into the Intel 
MDS* format, which is an ASCII-hexadecimal format. 

The destination address range is specified by the incoming data and need not be 
specified in the BEG and END registers. Furthermore, if the data is properly 
received, the BEG and END registers contain the low and high limits of the 
loaded data, regardless of the initial register settings. In addition, the limits will 
always be correct even if non-contiguous data is loaded. 

To use this Code Function, connect the RS-232C input to the source of 
information, start this routine and then enable the source to"download" the 
appropriate data. During the transfer, note the displays showing the data being 
loaded. If there are no errors, the end-of-file record completes the transfer and 
the displays contain CODE C3. The Trace Memory contains a record of the last 
252 cycles of the transfer. 

Error Codes— During the data transfer process, various types of errors can 
occur. If an error occurs, the Diagnostic Emulator emits three beeps and displays 
the appropriate error code. The Trace Memory will contain a record of the 
address and erroneous data. Once an error is detected ihe transfer process is 
aborted and may not be resumed. The C3 Code Function Error Codes are 
listed in Table 7-3.1 



MDS is an Intel Trademark. 
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Table 7-3.1 C3 and C7 Code 

Function Error Codes 



CODE DESCRIPTION 

01 Framing Error. The serial data character is not properly framed by start and stop bits. 
This error may be caused by an incorrect setting of the baud rate selector or by noise 
on the transmission link. 

02 Overrun Error. This error may occur if the processor is operated with an extremely low 
clock frequency while receiving data at high baud rates. 

11 Non-Hexadecimal Character Received. This error indicates that a hex character was 
expected at some point, but a non-hex character was received. 

12 Sum-Check Error. In the Intel MDS format each record contains an eight-bit check- 
sum to ensure data integrity. If this sum is incorrect, this error code is given. 

16 Non-Zero Record Type. If the record type byte is other than zero (except for the end 

of file record), this error is signaled. 

21 Target Memory Write Error. If an attempt is made to load data to an area of memory 

containing no RAM or faulty RAM, this error occurs. This error is detected by doing a 
read-back-check of each location as it is stored, and recording both the write cycle and 
the read cycle in Trace Memory. After the error occurs register ADDR will contain the 
address of the faulty location while register DATA will contain the data the EM- 180 
attempted to store. 

CODE C4-DUMP TARGET TO SERIAL LINK 

This Code Function C4 transfers data from a selected area of Target Memory to 
the serial RS-232C output. The data being output is ASCII-Hexadecimal and is 
compatible with the Intel MDS format. The use of this function requires the user 
to specify the address range. The BEG register contains the starting address 
while the END register contains the address of the last location to be output. 

To use this Code Function, first specify the address limits, next prepare the 
receiving device to accept data, then start the transfer by executing CODE C4. 
During the transfer the display shows the address and data currently being 
Iransmitted. When transmission is completed, the displays show CODE C4 and 
the Trace Memory contains a record of the last 252 cycles. 

The rate of transfer can be controlled by the receiving device. If enabled by the 
Option-Switch (with position 3 open), the CTS line (Clear-to-Send) can prevent 
output if held in the marking (negative) condition. In the spacing (positive) 
condition, output speed is determined by the baud rate selected. 

Each record is followed by a carriage return, line feed and two null characters. 
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CODE C5-LOAD OVERLAY RAM FROM TARGET MEMORY 

The Code Function C5 transfers data from a selected area of target memory 
space to the equivalent area in Overlay Memory. To use this Code Function the 
Overlay memory must first be located at the proper address by rotating the 
thumb-wheel switch. The Overlay is then enabled by setting the selector switch 
to the appropriate position. Then the BEG and END registers are set to the 
range of addresses over which data is to be transferred. The last step is to call 
the Code Function to execute the transfer. While executing, the displays show 
the addresses and data. When data transfer is completed, the displays show 
CODE C5 and the Trace Memory contains a record of the last 252 cycles of the 
data transfer. 

If a non-verify occurs during the transfer, the Diagnostic Emulator emits three 
beeps and temporarily halts the transfer. The error may be skipped and the 
transfer resumed by depressing INC, or the operation may be aborted by 
depressing a mode select keyswitch, such as CODE. While the operation is 
halted, the address and the data that failed to verify is shown on the display. By 
depressing and holding the EXAM keyswitch, the correct target data may be 
displayed. 



CODE C6-VERIFY RAM OVERLAY WITH TARGET MEMORY 

The Code Function C6 compares data from a selected area of Target Memory 
to the equivalent area in Overlay Memory. 

For information on the operation of this function, see Code C5. 

CODE C7-VERIFY TARGET WITH SERIAL LINK 

The Code Function C7 is nearly identical to the C3 Code Function. It differs in 
two respects: 

1. Data is not stored to target memory but only verified. 

2. A non-verify results in Error 22 and the compare operation is aborted. 
Register ADDR will contain the address of the non-compare while register 
DATA will contain the data that was supposed to be in the target memory 
location. 
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CODE C8 - FILL MEMORY WITH DATA 

The Code Function C8 is used to fill a block of target memory or RAM Overlay 
with the same data, usually all one's (FF) or all zeros. To use this Code 
Function, set the BEG and END registers to the range of target memory or 
RAM Overlay to be filled, load the DATA Register with the data to be stored 
then execute CODE C8. The Display shows the transfer as it takes place. After 
transfer is completed the display shows CODE C8 and the trace contains a 
record of the last 252 cycles of the transfer. 

K a location fails to store the correct data, the Diagnostic Emulator emits three 
beeps and temporarily halts the fill operation. The error may be skipped and the 
transfer resumed by depressing INC, or aborted by depressing a mode select 
keyswitch such as TRACE. While the operation is halted the address and the 
data that failed to verify are shown on the Display. By depressing and holding 
EXAM the correct data (which was in DATA) may be displayed. 

CODE C9- VERIFY MEMORY WITH DATA 

The Code Function C9 compares a block of target memory or RAM Overlay 
with the byte in register DATA. See the explanation of CODE C8 for the 
operation of the function. 

CODE CB- BLOCK MOVE 

The Code Function CB is used to move a block of data residing in the target 
system to a new location in target system RAM. Define the block of data to be 
moved by entering the address of the first byte of the block in the BEG register 
and the address of the last byte of the block in the END register. Enter the 
address of the first byte of the destination block in the ADDR register. Execute 
Code Function CB to move the data. 

This routine is able to move the block of data to a higher address or to a lower 
address. In addition, the blocks may overlap in any manner and moved without 
loss of data; for example, a block of 2K bytes could be moved up or down by 
fifteen positions. 

The entire destination block must be in writeable memory. 

CODE CC-DATA OUTPUT TO SERIAL PORT IN HEX AND ASCII 
FORMAT 

This Code Function provides a formatted dump of a block of memory to the 
serial port The memory block is defined by the addresses contained in the BEG 
and END registers. When the function is executed, data will be output from the 
serial port in the format shown in Figure 7-3.2. 
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figure 7-3.2. Memory Dump Format 



? 



# 



& 



*r 



0000 


00 


01 


02 


03 


04 


05 


06 


07 


08 


09 


OA 


OB 


OC 


OD 


OE 


OF 


0010 


10 


11 


12 


13 


14 


15 


16 


17 


18 


19 


1A 


IB 


1C 


ID 


IE 


IF 


0020 


20 


21 


22 


23 


24 


25 


26 


27 


28 


29 


2A 


2B 


2C 


2D 


2E 


2F 


0030 


30 


31 


32 


33 


34 


35 


36 


37 


38 


39 


3A 


3B 


3C 


3D 


3E 


3F 


0040 


40 


41 


42 


43 


44 


45 


46 


47 


48 


49 


4A 


4B 


4C 


4D 


4E 


4F 


0050 


50 


51 


52 


53 


54 


55 


56 


57 


58 


59 


5A 


5B 


5C 


5D 


5E 


5F 


0060 


60 


61 


62 


63 


64 


65 


66 


67 


68 


69 


6A 


6B 


6C 


6D 


6E 


6F 


0070 


70 


71 


72 


73 


74 


75 


76 


77 


78 


79 


7A 


7B 


7C 


7D 


7E 


7F 


0080 


80 


81 


82 


83 


84 


85 


86 


87 


88 


89 


8A 


8B 


8C 


8D 


8E 


8F 


0090 


90 


91 


92 


93 


94 


95 


96 


97 


98 


99 


9A 


9B 


9C 


9D 


9E 


9F 


00A0 


AO 


Al 


A2 


A3 


A4 


A5 


A6 


A7 


A8 


A9 


AA 


AB 


AC 


AD 


AE 


AF 


00B0 


BO 


Bl 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


BA 


BB 


BC 


BD 


BE 


BF 


OOCO 


CO 


CI 


C2 


C3 


C4 


C5 


C6 


C7 


C8 


C9 


CA 


CB 


CC 


CD 


CE 


CF 


00D0 


DO 


Dl 


D2 


D3 


D4 


D5 


D6 


D7 


D8 


D9 


DA 


DB 


DC 


DD 


DE 


DF 


00E0 


EO 


El 


E2 


E3 


E4 


E5 


E6 


E7 


E8 


E9 


EA 


EB 


EC 


ED 


EE 


EF 


00F0 


FO 


Fl 


F2 


F3 


F4 


F5 


F6 


F7 


F8 


F9 


FA 


FB 


FC 


FD 


FE 


00 


0100 


07 


07 


DD 


77 


00 


07 


DD 


77 


01 


07 


DD 


77 


02 


07 


DD 


77 


0110 


03 


07 


DD 


77 


04 


07 


DD 


77 


05 


07 


DD 


77 


06 


07 


DD 


77 


0120 


07 


C9 


21 


00 


10 


DD 


21 


00 


30 


OE 


00 


IE 


00 


41 


OC 


78 


0130 


A9 


Al 


28 


IF 


47 


AB 


5F 


16 


86 


78 


A3 


28 


02 


16 


C6 


78 


0140 


06 


07 


OF 


38 


02 


10 


FB 


36 


DD 


23 


36 


CB 


23 


70 


23 


72 


0150 


23 


18 


DA 


36 


E9 


21 


74 


01 


DD 


CB 


07 


86 


DD 


CB 


06 


86 


0160 


DD 


CB 


05 


86 


DD 


CB 


04 


86 


DD 


CB 


03 


86 


DD 


CB 


02 


86 



& 



01234567891 »<=>? 
GABCDEFGHIJKLHNO 
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" sbcdef 3hi Jklnno 
porstuvwxyz-C I >" 



w 
w 
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.8 

.6 



. w 
,w 
! . 

— ♦ 

.6 
t. 



» w 

« w 

* t 

x.< 

*6. 

♦ ♦ ♦ 

♦ * ♦ 



u 
w 
A.x 

. f X 



NOTE: Memory data formatted into lines of 16 Bytes with the address of the 
first Byte at the left margin. 



CODE CE- REPEAT SEGMENT OF DATA OVER BLOCK 

The purpose of Code Function CE is to make replicas of a block of data 
throughout a larger block. For example, suppose it is desired to have a block of 
identical jump instructions throughout memory. This may be accomplished by 
first entering the instruction (3 bytes) in the first three locations of the block. 
Next, enter the length of the block (3) in the DATA register; enter the address of 
the first location of the block in the BEG register (this is the same address as the 
first byte of the jump instruction); finally, enter the last address of the block in the 
END register. When the function is executed, the jump instruction will be copied 
as many times as it will fit in the specified block. 
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7-4 GROUP D: 

MISCELLANEOUS 



CODE DO -CLEAR INTERRUPT ENABLE FLIP-FLOP 

The interrupt enable flip-flop of the emulation processor is cleared so that the 
next time the processor starts running, interrupts will not be allowed. 

CODE Dl-SET INTERRUPT ENABLE FLIP-FLOP 

The interrupt enable flip-flop of the emulation processor is set so that the next 
time the processor starts running, interrupts will be allowed. 

CODE D2- DISPLAY CLOCK FREQUENCY 

This Code Function is a routine that determines the clock frequency of the 
emulation processor by comparing the instruction execution rate of the processor 
with the EM-180 internal 1.2 KHz reference frequency. The internal reference 
frequency is derived from the crystal controlled UART clock. The frequency is 
displayed on the ADDRESS display and is given in kilohertz. For example, a 
Z-80 operating with a 4.0 MHz clock will display 4000 (kilohertz) on the 
ADDRESS displays when CODE D2 is executed. The result is accurate to about 
± .01% (the accuracy of the UART crystal.) 

CODE D3-DISPLAY PROM/ROM SIGNATURE 

The purpose of this Code Function is to provide a convenient way of verifying 
that all bits in a PROM or ROM are correct. The routine operates by reading 
each 8-bit byte in a specified range and shifting the bits into a firmware 
implemented feedback shift register. By this means, the routine calculates a 
16-bit check value that is displayed as a 4-digit hexadecimal signature on the 
ADDRESS display. This signature has a very high probability (.9998) of being 
unique for any given bit pattern in a ROM. 

A PROM or ROM signature is obtained by setting the first address of the ROM 
in the BEG register and the last address of the ROM in the END register; then 
execute the routine. The Code Function routine will calculate and display the 
ROM signature. If the correct signature has been obtained previously with a 
known good ROM, then the ROM under test is good if it has the same signature. 

There is a technique that may be used to create PROMs or ROMs whose 
signatures are zero. For the method to work, the last two locations of the ROMs 
must be unused. Proceed as follows: 

1. Program a PROM with the desired information, making sure that the last 
two bytes are zeros. 

2. Determine the signature of the PROM using the CODE D3 function. 
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3. Program a new PROM with the desired information, but replace the last two 
bytes, which previously were zero, with the bit pattern of the signature 
obtained in Step 2. '* 

Now, while the signature of the new PROM is being calculated, the routine will 
arrive at a point just prior to processing the last two bytes of the PROM and at 
that time, the shift register will contain the signature of the PROM as calculated 
in Step 2; entry of the last two bytes, containing the same bit pattern as that 
already in the shift register results in the shift register reaching a final value 
of zero when computation is complete. Thus, the PROM will have a signature 
of 0000. 

CODE D4- OUTPUT 50 NULS TO SERIAL PORT 

This Code Function outputs 50 nul characters (00 16 ) to the serial port for the 
purpose of providing leader or trailer for users using punched paper tape as a 
data storage media. There are no parameters for this Code Function. 

CODE D5-CALL USER ROUTINE IN INTERNAL RAM AT 3000 )6 

CODE D6-CALL USER ROUTINE IN INTERNAL RAM AT 3003 I6 

These two Code Functions provide a means for the user to transfer control to 
routines that have been entered into the EM- 180 internal scratch pad RAM for 
various reasons. To make use of this feature, the user must understand the 
requirements of the programs that run in the EM- 180 internal environment. 
See Section 8— User Implemented Code Functions. 

CODE D7- CLEAR TRACE MEMORY 

The EM- 180 Trace Memory is cleared when power is applied as part of the 
power-on-reset operations. Code Function D7 is used to clear the Trace 
Memory at any other time. This routine does not use any parameters. 

CODE D8- DISASSEMBLE AND OUTPUT ENTIRE CONTENT OF 
TRACE MEMORY (IF DISASSEMBLER FIRMWARE 
IS INSTALLED) 

This Code Function outputs the entire content of the Trace Memory to the serial 
port in the standard disassembler format (Code E2, 72-character lines*). This 
routine may be called even if the regular disassembly feature of the EM- 180 is 
disabled. Data output may be suspended for a moment by depressing the 
EXAM key; when the key is released, data output will continue. See Section 6 
—Disassembly. 



"The disassembly format can be changed by executing Code El or E3 before executing 
Code D8. 
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CODE D9 - HALT CPU 

Code Function D9 causes the CPU to execute a HALT instruction, thereby 
halting the CPU. It is recommended that the CPU be halted any time that an 
EPROM is inserted into or removed from the Front Panel Diagnostic PROM 
Socket to avoid the possibility of crashing the internal control program of the 
EM-180. After the CPU has been halted, RESET must be used to resume 
normal operation. There are no parameters for this function. 

CODE DA- DISPLAY REVISION NUMBER FOR CONTROL PROM 

CODE DB- DISPLAY REVISION NUMBER FOR DISASSEMBLY 
PROM 

These two Code Functions display the date and revision information for the 
control PROM software and the disassembly PROM software respectively. The 
format is as follows: 



ADDRESS 
DISPLAY 



DATA 
DISPLAY 



Revision number (0,1,2,...) 
Revision letter (A,B,C,...) 
Day of Month (1-31) 

Month (1, 2, 3 9, A, B, C) 

Year (0, 1, 2, ... 9) 



CODE DC -CALCULATE BRANCH OFFSETS 

Code Function DC is intended to simplify the task of calculating branch offsets 
for Z-80 relative branch instructions. To use this routine, enter the address of the 
destination of the branch instruction in the BEG register; enter the address of the 
uyie lGuGWiTKj me brancn instrucuon m me PusL)i\ register. L~xecUie me 
function and the Address Display will show two digits that are the required 
branch offset. If the required offset is too large to be reached by branch 
instructions, then four digits will be displayed showing the offset. 



AMCMI^riKl 



63 




APPLIED 
MICROSYSTEMS 




7-5 GROUP E: CHANGE 

DEFAULT PARAMETERS 



CODE DD - SELF TEST OF INTERNAL PROM DATA 

Code Function DD is used to perform a check of the data in the internal 
PROMS— the Control PROM and the Optional Disassembly PROM. When this 
function is called, the data display will show 01 while the first 4K (Control 
PROM) is being tested and 02 while the second 4K (Disassembly PROM) is 
being tested. 

A failure of this test will result in three beeps and the display will show EC 31 if 
the Control PROM failed or EC 32 if the Disassembly PROM failed. 

CODE DE- OUTPUT LINE ENDING SEQUENCE TO SERIAL PORT 

This Code Function outputs the line ending sequence to the serial port consisting 
of a carriage return, a line feed, and two null characters. The routine is used to 
obtain a new line on a CRT or other ASCII display. 

CODE DF- DISPLAY HOURS, MINUTES, SECONDS 

Code Function DF places the EM- 180 in a clock mode that counts hours, 
minutes and seconds on the Address and Data displays. To set the initial display, 
enter the desired hours and minutes into the ADDR register and the desired 
seconds display into the DATA register. Then execute the function to start the 
clock. If the initial values are set to zero, then the clock will indicate elapsed lime 
from 0000 00 to 1259 59 (13 hours). 



CODE E0- DISABLE DISASSEMBLY (DEFAULT) 

Code Function E0 is used to disable the disassembly software if it is in operation. 
See Section 6— Disassembly. 

CODE El -ENABLE DISASSEMBLY 

Code Function El enables the disassembly firmware and configures the firmware 
to output 80-character lines with one line of register display. See Section 6. 

CODE E2- ENABLE DISASSEMBLY 

Code Function E2 enables the disassembly firmware and configures the firmware 
to output 72-character lines with one line of register display. See Section 6. 

CODE E3 - ENABLE DISASSEMBLY 

Code Function E3 enables the disassembly firmware and configures the firmware 
to output 72-character lines with two lines of register display. This is the only 
format that displays all the Z-80 internal registers of general interest. See Section 
6, Disassembly. 



64 



AMC9113 5-81 



'•f^nTTT 



BUILT-IN DIAGNOSTIC FUNCTIONS 



7-6 GROUP F: INTERNAL 
OPERATIONS 



CODE F-SET INTROSPECTION MODE 

Execution of this Code Function sets the EM- 180 so that its own internal address 
space becomes the"target system". After execution of the CODE F function, 
memory examine and store operations will be directed to the EM- 180 internal 
address space; programs interna! to the EM-180 may be executed in single-step 
mode and other internal operations performed. See Section 8 — User 
Implemented Code Functions. 

CODE F0, Fl, ... F9 

Code Functions F0 through F9 are used to set up the EM-180 to debug user 
programs residing in the front panel Diagnostic PROM Socket. These functions 
each set the emulator into"introspection" mode so that the internal address space 
is accessible, set the stack pointer to 3060i 6 (the top of the interna! user RAM 
area) and set the program counter to the starting address of the respective user 
Code Function. The EM-180 is then ready to execute the user's program in 
single-step mode or at full speed; breakpoints may be set and registers 
examined, and other normal debugging activities carried out. 
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8-1 OVERVIEW 



The EM- 180 Diagnostic Emulator has a Iow-insertion-force socket on the front 
panel that is designed to accept EPROMs similar to the Intel 2716 or 2732 
devices. This front panel socket is called the Diagnostic PROM Socket. The 
purpose of the Diagnostic PROM Socket is to provide a means whereby the user 
may insert EPROMs programmed with his own diagnostic routines and execute 
them in a convenient manner from the EM- 180 Keyboard. These user routines 
may perform almost any imaginable function. In most cases, the user will 
probably write special test or diagnostic routines to help test portions of the target 
system for which no Built-in Code Functions are provided. This discussion 
provides a view of the internal environment of the EM-180 from the 
programmer's perspective and is intended to provide the information needed by 
the user to write and debug his own Code Functions. 

The programmer is already familiar with the environment of his own target 
system. He knows there is a 64K byte address space called the Memory Address 
Space and within this address space are various blocks of ROM, RAM and, in 
some systems, I/O control or data registers. In addition, there is a 256-byte I/O 
address space which, in most systems, contains the addresses of I/O devices. 

The EM-180 also has an internal address space with its own ROM, RAM, and 
I/O. The EM-180 control program and Built-in Code Functions reside in this 
address space. Any EPROM plugged into the Diagnostic PROM Socket also 
appears in this internal address space. It is thus possible for User Code Functions 
to access all Diagnostic Emulator facilities and to function exactly as if they were 
factory-programmed . 

However, the Code Function programs executing within the internal address 
space do not have direct access to the user's system target address space. If it is 
necessary for a Code Function to read or write to the external target system, it 
must do so in cooperation with the Diagnostic Emulator hardware circuits. 
Consequently, a rigidly defined routine must be executed to perform read or 
write operations to the target system. The Built-in Code Functions, as well as the 
EXAMINE and STORE routines, use EM-180 control program subroutines, and 
the user may also use these same subroutines to read and write to the target 
program address space. 
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8-2 INTERNAL ENVIRONMENT 



Figure 8-2.1. EM-180 

Internal Memory Map 



The internal environment of the EM-180 contains ROM, RAM and I/O. The 
I/O devices of the EM-180 are memory mapped. Figure 8-2.1 shows an 
overview of the EM-180 internal address space. 



0000 



07FF CONTROL ROM 1 
0800 (U103) 

2716 or 2732 



1.-J 0FFF 
1000 



17FF 
1800 



CONTROL ROM 2 

(U104) 

2732 



L.-J 1FFF 
2000 



27FF 
2800 



FRONT PANEL 
DIAGNOSTIC EPROM 
2716 or 2732 



□ 



2FFF 
3000 



30FF 



SCRATCHPAD RAM 
(See Fig. 8-2.2) 
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8-2.1 ROM 



8-2.2 FRONT PANEL EPROM 
SOCKET 



8-2.3 SCRATCHPAD RAM 



The EM- 180 has two sockets, located on the Keyboard circuit card, that accept 
EPROMs or ROMs that contain the control program for the unit. The circuit 
board connections are normally set up for EPROMs or ROMs having the Intel 
2732 pinout; a jumper modification of the board allows use of the 2K byte 2716 
as well. See Figure 8-2.1. 



The EM-180 Front Panel EPROM Socket also accepts EPROMs of the 2716 or 
2732 variety. A small switch located in the center of the socket selects the 
appropriate connections for either the 2K byte or 4K byte EPROM types. In the 
internal address space, the EPROM plugged into the Front Panel Socket will 
appear in the address range of 2000 16 to 27FF J6 (2716) or 2000 16 to 2FFF 16 
(2732) . It is not possible to have this EPROM appear in the external (target) 
address space. See Figure 8-2.1. 



The EM-180 also contains a small amount of Scratchpad RAM in the internal 
address space that is used by the control program in keeping track of the status 
of the emulator and the emulation processor. The Scratchpad RAM resides in 
the internal address space at addresses 3000 I6 to 30FF 16 . Figure 8-2.2 shows a 
detail of the Scratchpad RAM. The first 96 bytes of the RAM are available to 
user-written Code Function programs. 

The Scratchpad RAM also contains the area where the processor registers are 
saved each time the emulation processor pauses; also, the saved register values 
are restored each time the emulation processor begins to run. User implemented 
programs may obtain these register values or even alter them if desired. The 
user should carefully avoid altering any of the data contained in the firmware 
stack area or firmware scratchpad locations to avoid crashing the control 
program. 

NOTE: EM-180's with serial #1801135 or higher have an additional 768 
Bytes of Scratchpad RAM residing from 3100i 6 to 33FFi 6 . This additional RAM 
is available for user written code function programs. 
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Figure 8-2.2. Map of Internal 
Scratchpad RAM 



ADDRESS 



3000 SCRAM 



305F 
3060 



30B2 
30B3 



30DF 




30E0 


RPC 


30E2 


RSP 


30E4 


RK 


30E6 


RIY 


30E8 


RPHL 


30EA 


RPDE 


30EC 


RPBC 


30EE 


RPAF 


30F0 


FHL 


30F2 


RDE 


30F4 


RBC 


30F6 


RAF 


30F8 


RBEG 


30FA 


REND 


30FC 


RADR 


30FE 


RDTA 


30FF 


FLAGS 
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For use by user written code function programs. 
(96 Bytes) (See Sec. 8-2.3.) 



i 4 



Firmware scratchpad locations used by emulator 
control program. (83 Bytes) 



* i 



Emulator firmware stack area. (45 Bytes) 



16 



16 



16 



16 



16 



16 



16 



16 



16 



16 



16 



16 



16 



16 



16 



Target Register PC 
Target Register SP 
Target Index Register X 
Target Index Register Y 
Target Register HL' 
Target Register DE* 
Target Register BC" 
Target Register AP 
Target Register HL 
Target Register DE 
Target Register BC 
Target Register AF 
Begin Pointer 
End Pointer 
Current Address of Test 
Current Data 
Flag Display Data 

TOTAL: 



(2 Bytes) 


(2 Bytes) 


(2 Bytes) 


(2 Bytes) 


(2 Bytes) 


(2 Bytes) 


(2 Bytes) 


(2 Bytes) 


(2 Bytes) 


(2 Bytes) 


(2 Bytes) 


(2 Bytes) 


(2 Bytes) 


(2 Bytes) 


(2 Bytes) 


(lByte) 


(lByte) 


256 Bytes 
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8-2.4 I/O DEVICES 



The EM-180 control program, running in the internal address space, has access 
to various I/O registers associated with different components of the emulator. 
Some users may wish to create special programs that control the EM-180 
components in a way different than that provided for by the standard software, 
and for that reason, this detailed information is provided. In most cases, 
however, the user will be able to obtain the desired result by using I/O handler 
subroutines that are already present in the EM-180 firmware. Section 8-6 
provides information on the characteristics and use of the User Accessible 
Subroutines. 

KEYBOARD: The state of the Keyboard Keyswitches may be read by the 
processor at a series of eight addresses from 3480, 6 through 3487 16 . Four 
Keyswitches may be read at each of the input addresses as shown in Figure 
8-2.3. A key depression causes the corresponding bit to go low as seen in the 
input data. For example, if Key 9 is depressed, bit 1 of location 3482, 6 will be 
low. Bits 4, 5, 6 and 7 of all eight of the input ports see the same data; bit 4 in 
all locations will be low if a jumper on the Keyboard called the Option A jumber 
is installed. Bit 5 in all locations senses the state of pin 61 on the keyboard card 
connector; this pin is left open in the EM-180. Bit 6 will be low if the most 
recent system reset was caused by the power-on-reset circuitry; bit 6 will be high 
is the most recent system reset was caused by the RESET Key or a reset 
command from the target system. Bit 7 will be high if any of the following kys 
are depressed: RUN, RUN-BKFT or STEP. 

The user who decides to write software to directly read the Keyboard must be 
aware that there is no key debouncing or other processing of the key closure 
done by the hardware. Consequently, it is necessary to provide the keystroke 
debouncing, repeating key features or other special processing in the software 
that scans the Keyboard. There is a Keyboard scan routine already in the 
EM-180 which may be accessed by the user that provides the most commonly 
needed features. See Section 8-6. 

SERIAL INPUT/OUTPUT PORT: The EM-180 Diagnostic Emulator contains 
circuitry that implements a full-duplex (two-way) serial Input/Output port that 
conforms to RS-232C requirements. The baud-rate, parity and character length 
of the data transmitted and received is set up by hardware switches. (See 
Sections 9-2 and 9-3). The nature and format of data transmitted is under the 
control of software. The software is able to send data to the serial output circuits, 
read data from the serial input circuits and test the status of the serial port 
circuitry via three ports as shown in Figure 8-2.4. Data is transferred to and from 
the serial port by means of a Universal Asynchronous Receiver-Transmitter 
(UART). 

Data to be output through the serial port is written to the UART data write 
address. The data enters the UART transmit buffer register, and then enters the 
transmit shift register where it is shifted out in serial form bit by bit. New data 
may be written to the transmit buffer register as soon as the previous data has 
entered the transmit shift register and before it has completed the process of 
shifting out. 
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1'iijun- H 2.3 Keyboard Input 
Locations 



Figure 8-2.4. Serial Port Data and 
Status Locations 
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Bit read is '0* if key is depressed; 
otherwise T, 



o4oUi< 



3481 16 



3 2 10 

'654 



3482 16 










B 


A 


9 


S 






3483 16 










F 


E ' 


D 


C 



3484,, 



O4o9]6 



O40O|£ 



3487,, 











INC 


DEC 


EXAM 


STORE 












LOAD 
DATA 


TRACE 


I/O 
ADDR 


MEM 
ADDR 



UART DATA WRITE 



UART DATA READ 



UART STATUS READ 











REG 


BKPT 

B 


BKPT 

A 


CODE 



L 



'0* if Option A jumper installed. 

D" if pin 61 card edge is low. 

'0" if Power-On-Reset (cold start) 

T if Keyswitch Reset (warm start). 

T if RUN, RUN-BKPT or STEP keys are 



7 6 5 4 3 2 10 



7 6 5 4 3 2 10 



3400 16 
3475, 6 

Data Available 
Transmit Buffer Empty 
End of Character 

75 Hi_TU~ 
Framing Error 
Overrun Error 
1200 Hz _ 



* Clear-to-Send 
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The UART Status Register (Figure 8-2.4) contains two bits which inform the 
software of the status of the transmitter registers as follows: 

Bit 1, Transmit Buffer Empty, will be read as a '1' when the transmit buffer 
register may be loaded with another character. A '0' means that the transmit 
data register contains data that has not yet been moved into the transmit 
shift register. 

Bit 2, End of Character, will go to '1' at the time that a character has shifted 
out of the transmit shift register. If there is another character waiting in the 
Iransmit buffer register, then bit 2 will immediately go to '0' as the new character 
enters the shift register to be transmitted. 

Data received by the EM-180 through the serial port is entered into the UART 
receiver shift register. When an entire character has been received, it is 
transferred to the receiver holding register and is then available to the software by 
reading the data at the UART Data Read address. Several status bits in the 
UART Status Register (Figure 8-2.4) give information about the received data 
as follows: 

Bit 0, Data Available, goes to '1' when an entire character has been received 
and transferred to the receiver holding register. When the software reads the 
UART Data Read location, this bit is cleared to '0'. 

Bit 4, Framing Error, goes to '1' if the received character has no stop bit at 
the expected location. This usually means that the transmitting device is sending 
characters of different length or baud rate than the EM-180 is set up to receive. 
Noise may also cause this error. 

Bit 5, Overrun Error, goes to T if a previously received character in the 
receiver holding register is not read by the CPU before another character is 
received and transferred into the holding register. 

The clear-to-send input (Auxiliary Connector, Pin 5) is visible to the software as 
Bit 7 of the UART status register. This bit is '0' if clear-to-send is true (high); if 
clear-to-send is low or disconnected, this bit is T. (Note, however, that this bit 
may be forced to the '0' state by setting Option Switch 3 closed. See 
Section 9-2.) 
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Two other bits share the UART Status Register, but are not directly involved in 
the communications functions. 

Bit 3, 75 Hz, is a 75 Hz square wave that is derived from the bit-rate-generator 
crystal oscillator. This bit is seen by the software as alternate '1' and '0' with a 
13.33 mSEC full cycle. 

Bit 6, 1200 Hz, is a 1200 Hz square wave that is derived from the bit-rate- 
generator crystal oscillator. 

One additional output port is associated with the communications interface. This 
port confrok the Request-to-Send (RTS) signal that is output on Pin 4 of the 
Auxiliary Connector. 



7 6 5 4 3 2 10 



RTS 



XX X X X X X 



3475,, 



The RTS output port is located at address 3475 16 . Writing a T to Bit 5 of the 
port will set the RTS signal to its negative (marking, or OFF) state; writing a '0' 
sets the RTS signal positive (spacing or ON) . All of the remaining bits of the port 
are"don't care" and have no effect. 

HEXADECIMAL DISPLAYS AND TRACE MEMORY: The EM-180 Trace 
Memory is a 252 -word by 32-bit memory whose primary function is to record 
each bus cycle that occurs to the target system. At any given time, a single word 
of the Trace Memory is selected by an 8-bit register called the 'XADDR' (trace 
index address) register. If, for example, the XADDR register contains a 43, then 
the next bus cycle that occurs will be written into location 43 of the Trace 
Memory. Immediately after the data is written, the XADDR register is 
incremented (by hardware) so that the current Trace Memory address becomes 
44. If the emulation processor were executing a target program, each bus cycle 
is written into the Trace Memory and XADDR is incremented for the next cycle. 
When XADDR reaches its maximum value FF 16 and is again incremented, it 
overflows to 00 16 so that the first location of the memory effectively follows the 
last location. Thus the Trace Memory may be viewed as a ring memory in which 
each additional bus cycle may be entered in the next position around the ring. 
Once the Trace Memory is full, each additional bus cycle simply overwrites the 
oldest bus cycle in the memory. 

The Address and Data hexadecimal displays and the eight discrete Machine 
Cycle indicators are wired directly to the Trace Memory circuitry so that the 
current Trace Memory word (the word designated by the XADDR register) is 
always displayed unless the displays are explicitly blanked. 
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When the EM-180 is in the PAUSE mode, the internal control program has 
access to the Trace Memory and the displays by means of a set of five ports. 
See Figure 8-2.5. The five ports are as follows: 

XADDR This port gives access to the Trace Index Address register. The control 
(3600, 6 ) program may read this location to obtain the current value of the 

XADDR register, and may store new values in the register. Storing a 
new value in XADDR will change the current trace word that is 
accessed and displayed on the EM-180 display panel. 

TDATA This port gives access to the eight-bit wide portion of the current 
(3640, 6 ) Trace Memory word that records the data bus signals of each 

machine cycle. The control program may read this location to obtain 
the data portion of the current trace word, or may store new data to 
the data portion of the trace word. 

TADDL This port gives access to the eight-bit portion of the current trace word 
(3641, 6 ) that records the low order eight bits of the address bus of each 

machine cycle. The control program may read or write this location. 

TADDH This port gives access to the eight-bit portion of the current trace word 
(3642, 6 ) that records the high order eight-bits of the address bus. The control 
program may read or write this location. 

TCNTL This port gives access to the eight-bit portion of the current trace word 
(3643, 6 ) that records the control bits of each machine cycle. The control 

program may read or write this location. The control bits are arranged 

in the port as shown below: 



76543210 



TCNTL 



3643 16 



- WR 

- RD 

- IACK 

- IORQ 

- EXT 

- BKPT 

- Ml' 

- Ml 



Any time that the control program writes new data into the Trace Memory, the 
data stored will immediately be seen on the appropriate displays. 
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Figure 8-2.5. Trace Memory Format 



XADDR 



3600., 



BF 



TRACE INDEX ADDRESS 



3600,, 

3640„ 
3641,, 
3642,, 



XADDR 
I TDATA 

Jtaddl 
Jtaddh 
Jtcntl 



3641 !6 3642 i6 
3640 16 LOW HI 3643 lt 

DATA ADDR ADDR CONTROL 




CURRENT TRACE WORD 




TRACE MEMORY 
252 words by 32 bits 



• TRACE MEMORY ACCESS PORTS 
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SPEAKER: The EM- 180 incorporates a very small dynamic speaker that is 
located on the Keyboard printed circuit board. A port is provided to control the 
current to the speaker to generate tones or other sounds under software control. 
It is necessary for the software to generate the actual waveform to be output by 
the speaker; there is no tone generation hardware in the EM- 180. The speaker 
output port is diagrammed below: 



765432 10 



SPKR 



X X X X X X X 



346B 16 



Writing a T to Bit 7 switches DC current to the speaker ON; writing '0' to Bit 7 
switches the current OFF. Bits through 6 of the port are"don't care" bits and 
have no effect. 

HARDWARE CONTROLS: There are a few additional output ports in the 
EM- 180 internal address space that are used for such functions as initiating the 
Binary Address mode, entering the"introspection" mode and other hardware 
features. Details of these ports are not contained in this manual. 
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BREAKPOINT COMPARATORS: A series of output ports is used to set up 
the Breakpoint Comparator address values and to control the desired operating 
mode. These ports are detailed below: 





7 6 


5 


4 


3 


2 


1 


BKPTAL 
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BKPTAH 














76543210 


BKPTBL 
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BKPTBH 














7 


TRIGA 




X 






7 


IOA 












7 


RDA 








7 


WRA 






7 


TRIGB 


x 


7 


IOB 


x 


7 


RDB 




X 




7 


WRB 








7 


RANGE 






7 


INLEXL 






7 




ATHENB 









3447 !6 Breakpoint A 
Low Order Address 

3448 16 Breakpoint A 
High Order Address 

3457,6 Breakpoint B 
Low Order Address 

3458, 6 Breakpoint B 
High Order Address 



3460 1( , Trigger A 
3461,6 I/O A 
3462,6 Read A 
3463, 6 Write A 
3464,6 Trigger B 
3465,6 I/O B 

3466,6 Read B 
3467 l6 Write B 
3468,6 Range Enable 



3469,6 Inclusive/ 
Exclusive Select 



346A.6 A-Then-B Enable 
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The ports BKPTAL and BKPTAH are used to set up the A Breakpoint address. 
The software should store the appropriate low and high order address bits to 
these ports. In the case of an I/O address which only has eight bits, the low 
order breakpoint address should be loaded; the high order breakpoint address 
port will have no effect. 

The ports BKPTBL and BKPTBH are used to set up the B Breakpoint address 
in a manner analogous to that described above. 



Two ports, TRIGA and TRIGB, are used to output pulses to the BKFT A and 
BKPT B output pins of the auxiliary connector (pins 12 and 13; see Figure 
9-1.1). Storing a T to the bit 7 position of the ports results in a high level at the 
corresponding output pin. To generate an output pulse the software must store a 
'1' followed by a '0' to the bit 7 position of the port. Bit positions 0-6 of the 
ports have no effect on the system. Inclusion of these ports in the EM- 180 
system enables user programmed Code Functions to output trigger signals to 
external equipment such as oscilloscopes or signature analyzers. 

Ports IOA and IOB are used to configure the breakpoint comparators to respond 
to either memory cycles or I/O cycles. Storing a 1' to the bit 7 position of either 
port will cause the associated breakpoint comparator to respond to I/O cycles 
with matching 8-bit low order address values. Storing a '0' to the bit 7 position 
of either port will cause the associated breakpoint comparator to respond to 
memory cycles with matching 16-bit address values. Bits through 6 of these 
ports have no effect. 

Ports RDA and RDB are used to enable the breakpoint comparators to respond 
to read cycles (either memory read cycles or I/O read cycles). The comparators 
will respond to read cycles if a T is stored to bit position 7 of the associated port. 

Ports WRA and WRB are used to enable the breakpoint comparators to respond 
to write cycles (either memory write cycles or I/O write cycles) by storing a T to 
bit position 7 of the relevant port. 

Notice that if T bits are stored to both the RDA and WRA ports, the A 
breakpoint comparator will respond to both read and write cycles. If a '0' is 
stored to both ports, the comparator will not respond to any cycles and is thus 
disabled. The B breakpoint comparator may be controlled in a similar manner. 

Three ports, RANGE, INLEXL and ATHENB are used to configure the break- 
point circuitry for several special operating modes (see Section 4-1.4). Any 
address in the range from A to B may be detected by writing a T to bit 7 of the 
INLEXL port. In order to include both end points of the range (address = A 
and address = B), it is recommended that both the A and B comparators also 
be enabled for read and write cycles. 
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8-3 ENTRY TO USER 
CODE FUNCTIONS 



stored to the INLEXL port, the inclusive range (everything from A to 
B) is detected. With a'O' stored to the INLEX1 port, the exclusive range (every 
address outside of the range A to B) is detected. Again, it is required that the A 
and B comparators also be set up to detect read and write cycles to ensure that 
both end points are included in the range. 

The ATHENB port is used to set up sequential operation of the comparators so 
that a breakpoint stop signal is generated only when the B address is 
encountered after the A address has previously been encountered. To set up this 
mode, store a T to the bit 7 position of the ATHENB port. Also, make sure 
that the RANGE circuitry is disabled ('0' to RANGE port). 



The Code Functions that are built in to the EM-180 are all called with keystroke 
sequences that begin with one of the letter keys, such as CODE Al, CODE C4 
and CODE D2. The Code Functions that use the decimal digit keys (0-9) are 
reserved for calling user programmed Code Functions. The keystroke sequences 
that are used to transfer control to user Code Functions are as follows: 



Key Sequence 



ff==fc 

CODE 

\i i) 


i 



■■ < 


1 1 

CODE 

1 J 


1 





(f — l> 

CODE 

k If 


2 

■■ 


(f 1 

CODE 

\i J 


T| 



V 1 

CODE 

i 1 


•1 




T T 

CODE 

it 3 


5 

i i 



1 r 

CODE 

i li 

t ? 

CODE 

ll 3 




7 



1 \ 

CODE 
J. 1 


8 






T T 
CODE 

i 1 


9 

,- — - 



Transfer Address 
2000 16 

2003,,, 
2006 16 
2009 16 

200C 16 
200F, 6 
2012 16 
2015 16 

2018 16 
201B 16 
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8-4 INTROSPECTION MODE 



8-4.1 CODEF 



8-5 GETTING TO AND FROM 
THE TARGET SYSTEM 



Thus, each of the key sequences has associated with it an entry address in the 
address space assigned to the Diagnostic Prom socket. It is the responsibility of 
the user to properly code the EPROM so that the desired actions occur for each 
entry address. It is necessary that the first instruction of every Code Function be 
a jump instruction (op-code C3 16 ) because the control software examines the 
Diagnostic Prom for the presence of this data before transferring control to it. 
See the examples given in Section 8-8. 



The EM- 180 Diagnostic Emulator has been designed with a special feature that is 
primarily intended as an aid to testing and debugging Code Function programs 
that have been programmed into EPROMs and plugged into the Diagnostic 
Prom socket. This special feature is the'lntrospection Mode" in which the 
EM-180 is caused to turn its attention to its own internal address space. In this 
way, the user may examine and store to the internal address space and, with 
certain limitations, may single step programs that execute in the internal address 
space. 



The introspection mode is entered by the key sequence: 



i; i 

CODE 

, , 


i. :i 

F 

,- ., 



After entering the CODE F mode, the user may examine or alter the internal 
memory space, step or run programs in the internal memory space, and review 
the contents of the trace memory after program execution. Breakpoints may also 
be used to halt program execution at appropriate internal addresses. The RESET 
key returns the EM-180 to normal operation. 



The EM-180 Control Program, together with the built-in diagnostic routines and 
any user-programmed code functions, executes within the EM-180 internal 
"protected" address space. As a consequence, programs in this internal address 
space do not have direct access to the target address space, but must make use 
of special hardware in the EM-180 logic to make the target address space 
accessible. Code Function Programs may have a requirement from time to time 
to do one of the following things: 

1. Read from or write to a location in the target address space. 

2. Read from or write to an I/O port address in the target address space. 

3. Go to and begin executing a program residing in the target address space. 

4. Return from running a program in the target address space to a program 
(user code function routine) in the internal address space. 

The following sections give detailed information on these functions. 
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EXAMINE AND STORE 



The simplest method of reading and writing data to the target system is to use 
subroutines that exist in the EM- 180 control program. Four subroutines are 
provided, as follows: 

STM Store the data contained in the accumulator to the target address 
specified in register-pair HL. 

EXM Load the accumulator from the target address specified in the register 
pair HL. 

STIO Store the data contained in the accumulator to the target I/O port 
specified by register C. 

EXIO Load the accumulator from the target I/O port specified by register C. 

The entry addresses of these subroutines (and other useful subroutines) are given 
in Section 8-6, User Accessible Subroutines. 

The four subroutines shown above operate by performing a read or a write 
operation to the specified address after commanding the EM- 180 hardware to 
make the target address space accessible during the transfer interval. The 
machine code listing of the EXM subroutine is shown below. 



Subroutine to read data from the target address 
specified by HL. Data is returned in A. The 
target read cycle is recorded in the trace memory. 
EXM PUSH BC 



LD A, OEOH 
LD (DELAY), A 
LD B, (HL) 



Delay value 

Command to hardware 
Read from target 



The data read during the target memory read 
;cyde above is automatically recorded in the 
;trace memory. The trace memory bookkeeping 
;values must be updated. 

LD A, (XADDR) ;Get trace index 

LD (XBASE), A ;Save 

DEC A 

:Put data in place and return to caller. 
LDA, B 
POPBC 
RET 
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8-5.2 PAUSE to RUN 



8-5.3 RUN to PAUSE 



The EM- 180 Control Program (firmware) is normally in control of the emulator 
when in the PAUSE mode. Depressing the RUN or RUN BKPT Key causes the 
control program to execute a sequence of operations that will load the processor 
registers with the values that had previously been saved (when the EM- 180 last 
entered the PAUSE mode) and then does a coordinated jump to the target 
system program. The EM- 180 hardware will switch to the target address space at 
the correct time for execution of the first instruction. It is possible for a user- 
written Code Function program to jump to a target system program in the same 
manner. This facility allows a user Code Function to place programs into the 
target address space (either user RAM or Overlay RAM) and then transfer 
control to that program. The target system program will then proceed to execute 
from within the target address space in a normal manner. 

The best way for the user to transfer control to a target system program is to use 
the existing EM- 180 internal routine. The following steps are suggested: 

1. Set up the user register save locations (addresses 3OE0, 6 to 30FF 16 in the 
scratchpad RAM) as desired. In particular, be sure to set the target program 
counter (RPC) location to the correct starting address. Other registers may be 
used, if desired, as a means of passing parameters to the target program. 

2. If the target program needs parameters or data from the internal program, 
then transfer the data to the target RAM using the STORE subroutine as 
appropriate. 

3. Perform the transfer of conlrol to the target program by jumping to the RUN 
routine at address 00A5 15 . 

The RUN routine will load the processor registers, do the required coordination 
of the EM-180 hardware, and start the target program running with the desired 
register values initialized. 



When a program is executing in the target address space and it is desired to 
transfer control into the internal software, there are only three ways available to 
cause this to occur. The are: 

1. Reset the system. 

2. Press the STEP key. 

3. Cause a breakpoint to occur, either with one of the breakpoint comparators 
or by means of the external breakpoint input connection. 

The first two methods are commonly used during manual operation; the third 
method may be used during manual operation or a sort of automatic operation 
in which it is desired that a Code Function set up the conditions to enable a 
target program to get back to the internal environment when it so desires. 
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8-5.4 RE-ENTRY JUMP 



The following steps are suggested as a method that will allow a program execu- 
ting in the target system address space to re-enter the internal address space: 

1. A Code Function program sets up one of the breakpoint comparators to 
monitor a pre-arranged address in the target memory space. 

2. The Code Function program sets up the re-entry jump address so that when 
the pre-arranged address is encountered and the breakpoint occurs, control 
will be given back to the Code Function program instead of the Keyboard 
Scan routine. See Section 8-5.4, below. 

3. A 80 16 must be stored to location 3477 16 to arm the breakpoint system. 

4. The Code Function program gives control to the target system program 
which then begins running. 

5. When the target system program is ready to return control to the Code 
Function program, it accesses the pre-arranged address and causes the 
breakpoint to occur. After the EM-180 software has saved the processor 
registers, it will jump to the address specified in Step 2 (above) and the 
Code Function program may proceed. 



Some applications require that the EM-180 control software transfer control to a 
user program each time emulation of the target program is halted. Such a 
program might be a"soft shutdown" program that prevents damage to the target 
system when execution is halted. (See Section 9-8, Soft Shutdown.) The 
EM-180 has the flexibility required to give control to a user-written subroutine 
each time the RUN to PAUSE sequence of the emulator is executed. Normally, 
this subroutine would be programmed into an EPROM and inserted into the 
front panel socket of the EM-180. 

In normal operation, the EM-180 executes an internal RUN to PAUSE routine 
each time the target program is halted. This routine first saves the processor 
registers in the scratchpad RAM save area, sets up the display to show the 
correct data, and finally goes to the keyboard input routine to determine the 
next action required. Before going to the keyboard routine, however, the RUN 
to PAUSE routine examines location 30A0 16 to see if it contains a jump 
instruction op-code (C3 16 ). If it does, the EM-180 will regard the jump 
instruction as the first instruction of a user-supplied subroutine, and will call the 
subroutine. (The EM-180 calls the address of the jump instruction which then 
jumps to the main body of the subroutine.) 



AMC91135-81 



85 



^APPLIED 
MICROSYSTEMS' 




The user-supplied subroutine will usually be located in the front panel EPROM, 
but may also be located in the user portion of the internal scratchpad RAM as 
the following example illustrates. 

The following small program may be entered from the keyboard of the EM- 180. 
It causes the EM-180 to beep each time it transfers from RUN to PAUSE. Enter 
the program with the following steps: 

1. Reset the EM-180, then execute CODE F to place the emulator in 
"introspection" mode. 

2. Enter the jump instruction: 

at 30A0 16 enter C3 l6 

at 30A1 16 enter 00 l6 

at 30A2, 6 enter 30, e . 

These three bytes constitute a jump instruction to location 3000, 6 in the 
internal address space. Location 3000, 6 is the first location of the user 
portion of the scratchpad RAM. 

3. At memory address 3000 16 , enter the following four-byte program: 

at 3000 16 enter CD 16 
at 3001, 6 enter D5 16 . 
at 3002, 6 enter 00, 6 
at 3003 16 enter C9 16 . 

4. Reset the emulator to exit the"introspection" mode and proceed to operate 
the emulator. Note that each time the emulator transfers from RUN to 
PAUSE, the beeper will sound. 

In most practical cases, the user subroutine will be located in the front panel 
EPROM instead of RAM as was done in this example. Also, the jump 
instruction may be easily written into addresses 30A0 through 30A2 by a Code 
Function program also residing in the EPROM. Executing the Code Function will 
enable the user subroutine and a second Code Function could be written to 
disable the subroutine by changing the jump instruction op-code to 00, 6 (or any 
other code except C3, 6 ). 
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8-6 USER ACCESSIBLE 
SUBROUTINES 



Table 8-6.1. 



User Accessbie 
Subroutines 



The EM- 180 Control Program contains handlers and subroutines which may be 
used by the user in constructing his own Code Functions. The entry addresses 
and functions of the routines are summarized in the following table. 



ADDRESS NAME 

0060 16 STM 



0063 I6 

0066 16 
0069 16 



EXM 



CODEFN 



006C 16 



006F 1( 



0072 16 



0075,, 



0078,, 



STIO 



EXIO 



LWLMIT 



HEJvIIT 



SIA 



007B 16 



SIB 



DESCRIPTION 

Store the date contained in the accumulator to the target 
address specified in register-pair HL. (Flags, register F, are 
altered.) 

Load the accumulator from the target address specified in 
register-pair HL. (Flags and accumulator altered.) 

(Not Used) 

Execute the built-in Code Function designated by the 
contents of the accumulator. For example, if the 
accumulator is loaded with A8, 6 and this subroutine called, 
then the EM- 180 will execute Code Function A8; if the 
Code Function completes successfully, this subroutine will 
return to the calling program. 

Store the data contained in the accumulator to the target 
I/O port specified by register C. (Flags may be altered.) 

Load the accumulator from the target I/O port specified by 
register C. (Flags and accumulator altered.) 

Compares HL to the BEGIN address; the subroutine 
returns with CY = 1 if HL = BEGIN. (Registers A and F 
may be altered.) 

Compares HL to the END address; the subroutine returns 
with CY = 1 if HL = END. (Registers A and F may be 
altered.) 

ASCII Serial Input. Serial data entered at the serial port is 
returned in the accumulator. Bit seven is always zero. 
Registers A and F may be altered. When this routine is 
called, the RTS line (request-to-send) automatically goes 
high. The RTS line goes low again whenever the XECUTE 
routine is entered. 

Binary Serial Input. Serial data entered at the serial port is 
returned in the accumulator. All eight bits are returned to 
the user without alteration. Registers A and F may be 
altered. When this routine is called, the RTS line (request- 
to-send) automatically goes high. The RTS line goes low 
again whenever the XECUTE routine is entered. 
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ADDRESS NAME 

007E I6 RHB 



0081 I6 



CNVHEX 



0084 16 
0087,, 

008A 16 



CRLF 



TAB 



008D„ 



0090, , 



NIB 



BYTE1 



DESCRIPTION 

Read-Hex-Byte. This subroutine obtains two ASCII 
characters from the serial port. It checks to see if the 
characters represent valid hexadecimal digits. If they are, 
they are then converted to an eight-bit binary number and 
the subroutine returns to the calling program with this result 
in the accumulator. If any characters received that are not 
valid hexadecimal characters, an error code (EC 11) is 
displayed and the Diagnostic Emulator must be reset to 
proceed. This subroutine alters the accumulator, flags and D 
register. The D register is used to accumulate a sum check 
of the data received. (All the eight-bit binary values are 
added into regfeter D, with overflows ignored.) 

Convert ASCII character to binary value. This subroutine 
expects an ASCII character in the accumulator that 
represents one of the digits, 0, 1, 2, . . . , 9 or one of the 
letters A, B, C, D, E, F. The character is converted into a 
numeric value corresponding to the ASCII-hex character in 
the accumulator. The routine returns with the value in the 
accumulator. If the ASCII character originally in the 
accumulator does not represent one of the hexadecimal 
digits, an error code will be displayed and the EM- 180 must 
be reset to proceed. 

(Not Used) 

Outputs a line ending sequence to the RS-232C port which 
consists of a carriage return (0D 16 ) line feed (0A, j, and two 
nuD characters (00, J. 

This subroutine outputs ASCII space characters (20, 6 ) until 
the total number of printable characters output since the last 
carriage return character (ODJ is equal to the number 
specified in the byte following the call to this routine. This 
routine is used to format output displays to CRT or printer 
terminals. No registers are altered. 

This subroutine converts the low-order 4 bits of the 
accumulator to one ASCII character representing the value 
in hexadecimal and outputs the character to the serial port. 

Convert the contents of the accumulator to two ASCII 
characters representing the value in hexadecimal, then 
output these characters to the RS-232 port. No registers 
are altered. 
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ADDRESS 

0093 I6 

0096 16 
0099 16 



NAME 

HEXOUT 

SO50NL 
ERROR1 



009C 16 
009F 16 



XECUTE 



00A2 16 



00A5 16 



STATE1 



RUN 



0OA8 ]6 



KCN 



DESCRIPTION 

This subroutine is the same as the BYTE routine except that 
the contents of the accumulator is added to the D register 
for computing a checksum. 

Output 50 ASCII null characters (00! J to the serial 
interface. This routine is primarily useful to produce blank 
tape leader on a paper (ape punch interfaced to the 
EM-180. 

Subroutine to report an error on the display. This routine 
shows the characters"EC" on the address display (meaning 
Error Code), displays the content of the accumulator in the 
data display, and emits three beeps. The routine then waits 
for the user to depress some mode selection key. This 
subroutine does not return to the calling program. 

(Not Used) 

This routine returns program control to the standard 
Diagnostic Emulator firmware and readies it for Keyboard 
input. K the user has changed the display, it will return to its 
former state. This routine does not return to the calling 
program. 

This routine places the Diagnostic Emulator in the TRACE 
VIEW mode and makes it ready to accept input from the 
Keyboard. This routine does not return to the calling 
program. (See XECUTE routine.) 

This routine loads the processor registers with the values in 
the scratchpad RAM save area and then does a jump to 
the target system. The address contained in the PC save 
location will be the address where target system execution 
will begin. 

User's Keyboard scan routine. Data representing the 
keyswitch depressed is returned in the accumulator. In 
addition, if the keyswitch depressed is one of the 
hexadecimal numeric keys, the carry bit (CY) is set to one 
(true) when the subroutine returns. This routine ignores the 
RUN, RUN BKPT and STEP keyswitches. The table 
shows the data returned in the accumulator for each 
keyswitch depression. 
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KEYSWITCH 


DATA 


KEYSWITCH 


DATA 


RESET 


* 





00,. 


RUN 




1 


01,. 


RUNBKPT 


* * 


2 


02,. 


STEP 




3 


03,. 


ODE 


18,. 


4 


04,. 


BKPTA 


19,. 


5 


05,. 


BKPTB 


1A, 6 


6 


06,. 


REG 


IB,. 


7 


07,. 


MEMADDR 


14,. 


8 


08,. 


I/O ADDR 


15,. 


9 


09,. 


TRACE 


16,. 


A 


0A,. 


LOAD DATA 


17,. 


B 


0B,. 


STORE 


10,. 


C 


oc,. 


EXAM 


11,. 


D 


0D 16 


DEC 


12,. 


E 


0E,. 


INC 


13,. 


F 


OF,. 



When RESET is depressed, the User's Code Function is 
aborted and the EM- 188 reinitialized. 
Keyswitches RUN, RUN BKPT and STEP are ignored by 
this routine. 



ADDRESS NAME DESCRIPTION 

00C6,. DSPCTL Display Control. This subroutine uses the low-order four-bits 

of the accumulator to control the blanking of the display 
digits. This is shown in the example below. 



DISPLAYS 



HIGH I LOW 



ADDR 



ADDR 



high! LOW 

DATA | DATA 



I 



L 



L 



1 



X X X B B B B ACCUMULATOR 



If a bit of the accumulator is a one when this subroutine is 
called, then the display digit or pair of digits corresponding to 
that bit ifluminaie(s). The accumulator and flags may be 
altered by this routine. 



90 



AMC 9113 5-81 



8-7 INTERRUPTS 



8-8 CODE FUNCTION 
EXAMPLE 



SIEClflKUM © 

USER IMPLEMENTED CODE FUNCTIONS 




00D5„ 



0028, „ 



BEEP 



SOUT 



0030 16 



1MSO 



A subroutine to beep the speaker located on the Keyboard 
printed circuit card. No registers are altered. 

Data in the accumulator is sent to the serial port. In 
addition, this subroutine affects a one byte counting location 
that is reset to zero each time a carriage return code is 
output (0D 16 ) and is incremented by one each time a print- 
able ASCII character is output This counting location is also 
affected and examined by the TAB routine as well as other 
output operations. This subroutine may also be called with 
an RST 5 instruction. 

The data byte following the subroutine call or restart code is 
sent to the serial port. No registers are altered. This 
subroutine may also be called with an RST 6 instruction. 



Target system interrupts are invisible to programs executing in the EM- 180 
internal environment. For this reason it is not possible to write Code Function 
programs that directly work or test the user's interrupt system. Nevertheless, it is 
possible for a Code Function program to test or work with interrupts as follows: 

1. The internal Code Function program, when it begins executing, first copies 
the interrupt portion of the routine to target system RAM. (If no RAM is 
available in the target system, the RAM Overlay may be used.) 

2. The Code Function program sets up one of the breakpoint comparators to 
facilitate re-entry into the internal environment. 

3. The Code Function program sets up the re-entry jump address in order to 
gain control after the breakpoint occurs (see sec. 8-5.4). 

4. The Code Function program writes a 80 16 to location 3477 16 to arm the 
breakpoint system. 

5. The Code Function program transfers control to the program copied to the 
target system. 

6. When the breakpoint occurs, the internal program may read results left in 
RAM by the target system routine and take whatever additional action is 
desired. See Section 8-5.3. 



Two examples of Code Function programs are given in this section. The first 
example is a very simple routine that writes a range of target system memory to 
zeros. 
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EXAMPLE 1: 



;iNrnALizE- 

CODEO 



ORG2000H 
JP CODEO 
JP XECUTE 
JPXECUTE 
JP XECUTE 
JPXECUTE 
JPXECUTE 
JP XECUTE 
JP XECUTE 
JPXECUTE 
JPXECUTE 



LDHL, 6000H 
LD B, OOH 



CODE ENTRY 
CODE1 
CODE 2 
CODE 3 
CODE 4 
CODE 5 
CODE 6 
CODE 7 
CODE 8 
CODE 9 



;MTIALIZE MEMORY POINTER 
jINITIALIZE BYTE COUNT 



;NOW LOOP TO CLEAR EACH TARGET MEMORY LOCATION 
FROM 6000H to 60FFH 



CI SUB A 

CALLSTM 
INCHL 
DECB 
JP NZ, CI 

XTT TO CONTROL PROGRAM 
JPXECUTE 

;DEFINE SUBROUTINE ADDRESSES 
STM EQU 0060H 

XECUTE EQU 009FH 

END 



;CLEAR ACCUMULATOR 
;STORE TO TARGET SYSTEM 
INCREMENT TO NEXT ADDRESS 
DECREMENT BYTE COUNT 
LOOP UNTIL COUNT EQUALS ZERO 



This example illustrates the following points: 

1. The program originates at location 2000, 6 because this is the start of the 
address range allocated for the Diagnostic PROM. 



2. 



The first instruction tells the program to jump to the actual starting point of 
tiie CODE program. This jump instruction provides room for the other 
entry points, each having its own jump instruction. In this simple example, 
only one Code Function is implemented; consequently a fuD set of jump 
instructions, as shown, is really not needed. Notice the CODE entry point 
has a jump instruction to the program; all other entry points jump to a 
routine labeled XECUTE. The XECUTE routine is one of several ways to 
exit a Code Function, giving control back to the Diagnostic Emulator 
firmware. A RET instruction could also be used. 



3. The Code Function program is written in standard Z-80 assembly language. 
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6. 



Whenever the Code Function program wishes to access the target system 
memory space, it may most easily do so by using subroutines already 
present in the Diagnostic Emulator firmware. In this example, the STM 
subroutine is called to perform the write operation to the target system. 

When the Code Function program has finished executing, it returns control 
to the Diagnostic Emulator firmware by jumping to the XECUTE routine. 

The EQU statements inform the assembler of the addresses of routines 
within the Diagnostic Emulator firmware— in this case, the addresses of the 
STM and XECUTE entry points. 



The second example is a 'scope loop program. This program rotates a bit 
through all eight positions of an output port. The port address used is selected as 
is usual for other built-in functions, the routine outputs a synchronizing pulse to 
the BKFT-A output pin of the auxiliary connector just before rotating the bit and 
outputs a pulse to the BKFT B output pin after it has moved the bit through all 
eight positions of the output port. This program loops indefinitely and must be 
terminated with the RESET Key. 



EXAMPLE 2: 



CODEO 



ORG 2000H 
JP CODEO 
LD SP, 03060H 



;SET UP STACK 



lOUTPUT START PULSE TO BKPT A OUTPUT- 
Cl LD A, OFFH 



LD (034C0H), A 

SUB A 

LD (034C0H), A 

;ROTATE BIT THROUGH OUTPUT PORT 

LD A, 030FDH 

LDC, A 

LD A, 01H 
C2 CALL STIO 

ADDA, A 

JP NZ, C2 



;TURN BKPT A ON 



;TURN BKPT A OFF 



;PICK UP PORT ADDRESS 

SET ACCUMULATOR BIT 
OUTPUT TO TARGET PORT 
SHIFT BIT LEFT 



FLOW HERE WHEN THE BIT HAS SHir i tD OUT 
OF THE ACCUMULATOR. NOW OUTPUT THE STOP 
PULSE TO THE BKPT B OUTPUT. 

LDA, OFFH 

LD (034C4H), A ;TURN BKPT B ON 

SUB A 

LD (034C4H) , A ;TURN BKPT B OFF 



;NOW REPEAT 



JPC1 



;DEFINE SUBROUTINE ADDRESS 
STIO EQU 0006C 

END 
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*1 AUXILIARY CONNECTOR 



Figure 9-1.1. J3- Auxiliary Connector 
Pinout (D-Subminiaiure, 

Female) 



The EM- 180 Diagnostic Emulator has a back panel auxiliary connector that is 
used as the connection point for the RS-232C communications signals and 
various other signals. Figure 9-1.1 shows the pinout of the auxiliary connector 
and the signals present on each of the pins. 



©©©©000000QQO 

©0©@©0©@000© 



Pin 



Pin 



1 


PROTECTIVE GROUND 


14 




2 


SERIAL DATA (OUT) (RS-232C) 


15 




3 


SERIAL DATA (IN) (RS-232C) 


16 




4 


REQUEST-TO-SEND (OUT) (RS-232C) 


17 




5 


CLEAR-TO-SEND (IN) (RS-232C) 


18 




6 


DATA-SET-Ready (NOT IMPLEMENTED) 


19 




7 


SIGNAL GROUND (RS-232Q 


20 


DATA TERMINAL READY 
(OUT) (RS-232C) 


8 




21 




9 


EXT BREAK-IN (ASYNCHRONOUS) 


22 


RUN (OUT) 


10 


EXT BREAK-IN (SYNCHRONOUS) 


23 


+ 5 VOLTS (OUT) 


11 


TRACE HOLD (IN) 


24 


GROUND 


12 


BKPT A and SA START (OUT) 


25 


SIGNATURE CLOCK 


13 


BKPT B and SA STOP (OUT) 




(OUT) 



Pins without associated signals shown are not connected within the EM- 180. 

The functions of the auxiliary connector signals are summarized below: 

Pin 1 Protective Ground: Connected in the EM- 180 to the chassis, and 

from the chassis to the protective ground terminal of the primary power 
input connector. 

Pin 2 Serial Data Out This signal is driven to nominal ± 12 volt levels by 
an RS-232C compatible driver. See Section 9-3 (Serial Interface) for 
format of serial data. 

Pin 3 Serial Data In: The EM- 180 accepts data on this pin that has voltage 
levels as specified by the EIA RS-232C specification and the format 
given in Section 9-3. 

Pin 4 Request to Send: This signal is driven to nominal ±12 volt levels by 
an RS-232C compatible driver. The state of this signal is determined by 
software in the EM- 180. 

Pin 5 Clear to Send: The EM- 180 accepts a signal on this pin having RS- 
232C voltage levels. The state of this signal may be read by the 
EM-180 control software. 
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Pin 7 



Pin 9 



Signal Ground: Connected in fie EM- IK) to the system logic ground 
which is isolated from the protective ground (Pin 1). Note, however, 
that this ground is connected to the emulator probe ground pin; then 
when the EM- 180 is connected to the target equipment, the target 
system logic ground and the EM- 180 logic ground are connected 
together and to the ground system of the equipment plugged into the 
Auxiliary Connector. 

External Break-In (Asynchronous): A TTL level input with an 
internal 3.3K pull-up resistor. If this input is pulled low, the Diagnostic 
Emulator stops executing the target program as though STEP were 
depressed or an Internal Breakpoint were detected. (If the Diagnostic 
Emulator is already in PAUSE, this has no effect) . This input stops 
execution even when the breakpoints are not enabled. 

Pin 10 External Break-In (Synchronous): Same as pin 9 except this is the 
clock synchronous input 

Pin 11 Trace Hold (In): A TTL level input with an internal 3.3K pull-up 
resistor. If the Diagnostic Emulator is executing a target program and 
this input is pulled low, further updating of the Trace Memory stops, 
although the program continues to execute. The contents of the Trace 
Memory are effectively frozen, and can be reviewed later after program 
execution has been halted. 

Pin 12 BKPT A and SA START (Out): A TTL level output providing a high- 
going pulse at the time breakpoint conditions are satisfied for the 
Breakpoint A Comparator. This signal can be used to trigger an 
oscilloscope at a particular point of program execution. It can also be 
used as the START signal for a signature analyzer. This signal may be 
set high or low under software control when the Diagnostic Emulator is 
in PAUSE. This permits diagnostic routines to generate sync pulses or 
signature analyzer START signals under direct program control. 

Pin 13 BKPT B and SA STOP (Out): A TTL level output associated with 

the Breakpoint B Comparator. It is functionally identical with the BKPT 
A signal described above. 

Pin 20 DATA TERMINAL READY: This signal is driven to a nominal + 12 
volts to indicate that the EM- 180 is ready to send data. Its signal state 
does not change. 

Pin 22 RUN (Out): A TTL level output that is active (low) if the EM- 180 is 

executing the target program or accessing the target address space. 

Pin 23+5 VOLTS (Out): Loading should not exceed .5 amp. 

Pin 24 GROUND: This is the return line for the + 5 volts available on pin 23. 
This line is internally connected to the signal ground (pin 7). 

Pin 25 SIGNATURE CLOCK (Out): A TTL level output signal (fflKECJ) 
from the CPU. It is primarily used as a clock for signature analysis 
testing of equipment for which the EM- 180 provides the stimulus. 
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9-2 OPTION SWITCHES 



Table 9-2.:. Set-up Characteristics 
for Serial Port. 



98 



The EM-180 has a set of eight small switches that are accessible from the back 
panel of the machine. These*switches are used to select optional operating 
characteristics of the EM-180 reset circuitry and communications interface. 



OPEN 



OFF 




CLOSED 



SWITCH: 



1,2 Set up RAM Overlay to output data to target system during read cycles to facilitate operation 
of Slog peripheral components. See Table below: 



SI 



S2 



OPEN OPEN 

OPEN CLOSED 

CLOSED OPEN 

CLOSED CLOSED 



DRIVE RAM OVERLAY DATA TO 
TARGET SYSTEM ON READ CYCLES 

NO 

YES, Ml CYCLES ONLY 

NO 

YES, ALL READ CYCLES 



3 H CLOSED, EM-180 ignores clear-to-send (CTS) signal and communications software will 
output data at any time on operator command. If OPEN, EM-180 will output data only if 
clear-to-send is in the ON (positive) state. 

4 If CLOSED, target system RESET signal will reset the EM- 180 in the same manner as the 
RESET Key. If OPEN, target system RESET signal will reset EM-180 emulation CPU but the 
operator station will not be reset. This makes it possible to emulate systems in which the CPU 
is made to restart at intervals as part of the normal operation of the system. 

5 If CLOSED, EM-180 RESET signal (from RESET Key or power-on-resef) is sent to target 
astern RESET (hrough the CPU reset pin. If OPEN, no reset of the target system is attempted. 

6,7,8 Set up characteristics of serial communications interface as shown in Table 9-2.1. 



SW6 SW7 SW8 









0* 








1 


1 








1 





1 





1 








1 


1 


1 


1 





1 


1 


1 



DATA BITS PER STOP 

CHARACTER BITS 

5" 1 

5* ' lVz 

6** 1 

6*' 2 

7 1 

7 2 

8 1 Normal Set-up 
8 2 



CLOSED 0, OPEN 1 



Standard EM-180 communications software requires at least 7 bits for operation. 
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The EM-180 Serial Interface is compatible with the RS-232C standard pin 
conventions and signaling levels. The signals and connections are given in 
Section 9-1 (Auxiliary Connector). 

The format of a serial word is shown in Figure 9-3.1. When no data is being 
transmitted, the Serial Data Out pin will be at the -12 volt level (marking). When 
the EM-180 sends a character, there will always be a START bit, followed by 5, 
6, 7 or 8 DATA bits, and 1, 1.5 or 2 STOP bits. The number of DATA bits 
and STOP bits are selected by the Option Switches on the back panel. See 
Section 9-2 (Option Switches) . 

The standard EM-180 software transmits and receives ASCII characters which 
require 7 bits for their representation. For this reason, the option switches must 
be set for 7 or 8 bit characters for proper operation. Some data terminals require 
two stop bite for proper operation and the EM-180 will operate with these 
terminals; one stop bit is recommended for most other terminals because a 
somewhat higher data rate is obtained if time is not given to unneeded stop bits. 

The EM-180 with standard software does not send or check parity. However, it 
is possible to have one of the data bits function as a parity bit if the parity 
generation and checking is done by software. 

Two additional signals that are used by the EM-180 are the Request-to-Send 
(Pin 4) output and the Clear-to-Send (Pin 5) input. The EM-180 standard 
software uses these signals%) coordinate the data transfer. When the EM-180 is 
ready to begin receiving data, it changes the Request-to-Send line from low to 
high and awaits data transmission. When the EM-180 has finished receiving 
data, it will return the Request-to-Send line to the low state. When the EM-180 
is ready to send a character, the software tests the condition of the Clear-to- 
Send line and transmission of the character proceeds only if Clear-to-Send is in 
the high state; the character is held if the signal is in the low state. Thus, a 
receiving device may control the transfer of data by taking the Clear-to-Send line 
high when more data is desired and low when not ready for data. The EM-180 
may be made to consider the Clear-to-Send line as always high by closing 
Option Switch 3 on the back panel. 

The serial port transmission rate is controlled by the rotary hexadecimal switch in 
the lower left comer of the back panel. The EM-180 is capable of 
communicating at baud rates from 50 Baud to 19,200 Baud. See Figure 9-3.1. 
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Figure 9-3. 1 . Serial Word Format. 



9-4 UPLOAD/DOWNLOAD 
PROTOCOL 



tl2V 



-12V 



START DO 



Dl D2 D3 D4 D5 D6 D7 STOP START DO 

I--" T---I -1 r -- T --- 

i ii i 



I 



t = time of one data element or "baud" 



Switch Position 


Baud Rate 


t 


D 


50 


20 


C 


75 


13.33 





110 


9.09 


B 


134.5 


7.43 


1 


150 


6.67 


A 


200 


5 


2 


300 


3.33 


9 


600 


1.67 


4 


1,200 


833 


5 


1,800 


556 


3,8 


2,400 


417 


6 


4,800 


208 


7 


9,600 


104 


E, F 


19,200 


52 



mSEC 



uSEC 



The EM-180 routines CODE C3 and CODE C4 initiate routines to load the 
target memory space with data from the serial link or dump data from the target 
address space to the serial link. The EM-180 uses a particular format to transfer 
the data. This format is compatible with the Intel family of development systems. 



m 



DATA RECORD 



Hi 



a 



Q 



DATA 



X 

On, 





I 



-ri 



-r 



START CHARACTER 

An ASCII colon is used to signal the start of a record. 

BYTE COUNT 

Two ASCII characters representing hexadecimal digits giving the number of data 
bytes in the record. 
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ADDRESS 

Four ASCII characters representing hexadecimal digits giving the address in 
target memory where the first of the data bytes of this record is to be located. 
The following bytes in the record are located in sequentially higher addresses 
in memory. 

RECORD TYPE 

Two ASCII characters representing hexadecimal digits that are encoded to 
designate the record type. For data records as defined here the Record Type will 
always be 00 16 . 

DATA 

Each two ASCII characters representing hexadecimal digits give the bit pattern of 
one eight-bit byte of data. The total number of data bytes in the record is given 
by the byte count. 

CHECK BYTE 

Two ASCII characters representing hexadecimal digits giving the value of a 
check byte. The value of the check byte is the two's complement of the sum of 
all the other bytes of the record; that is, the byte count plus the first byte of the 
address plus the second byte of the address plus the record type byte plus all of 
the data bytes. If the check byte is added to the sum of all the other bytes, the 
result will be zero. (The addition is performed modulo 256 in that any carry out 
of an eight bit result is ignored.) 

END-OF-FILE RECORD 

3 

H 

u 



. .'I 



5 u i 
1 £i 



If) 



a 

O u 



: 


—1 — 



1 


— 1 — 



1 - 


— r - 



1 


— 1 — 

1 

1 . 



START CHARACTER 

An ASCII colon is used to signal the start of a record. 

BYTE COUNT 

Two ASCII zeros. 

ADDRESS HELD 

Four ASCII charaters representing hexadecimal zeros, or the starting address of 
the program. 

RECORD TYPE FIELD 

Two ASCII characters representing the hexadecimal digits 01. 
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9-5 EXTERNAL BREAKPOINT 



Figure 9-5.1. Timing Relationships. 



9-6 TRACE HOLD 
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The EM- 180 Diagnostic Emulator is provided with an input that permits an 
external signal to halt the execution of the target program when the EM-180 is 
in the RUN mode. Pin 10 of the back panel Auxiliary Connector (J3) is the 
input connection. External Breakpoint is a TTL level input with a 3.3K resistor 
pull up to +5 volts. If this input is in the high state, or if the input is left open, 
then the EM-180 will run the target program in the normal manner. If this input 
is pulled low, the target program will halt; if the target program is already halted, 
the External Breakpoint signal will have no effect. 

The EM-180 samples the External Breakpoint input at the low-to-high transition 
of the clock that begins the final T-state of an instruction. If the signal is low at 
the sample time, the signal is entered into the Trace Memory, thus marking the 
cycle during which the signal was detected; circuitry in the EM-180 is also armed 
to halt program execution after completion of the current instruction. When the 
target program has been halted, the EM-180 firmware will determine which cycle 
of the last instruction caused the breakpoint and the Trace Memory will be 
positioned to display that cycle. Figure 9-5.1 shows the timing relationships of 
the External Breakpoint signal. 



i 



CLK 



j — V 



External Breakpoint 



Set-up: 150nSEC MIN- 



A 



/ 



-Last T State- 



\ 



/ 



Hold: nSEC MIN 



SET-UP PRIOR TO LOW-HIGH TRANSITION OF CLK: 150 nSEC MINIMUM. 
HOLD TIME AFTER LOW-HIGH TRANSITION OF CLK: nSEC MINIMUM. 

The EM-180 Diagnostic Emulator is provided with an input that permits external 
equipment to control the tracing of program execution. Pin 11 of the back panel 
Auxiliary Connector (J3) is the Trace Hold input. Trace Hold is a TTL level 
input with a 3.3K resistor pull up to +5 Volts. If this input is in the high state, 
or if the input is left open, then the Trace Memory operates normally. If this 
input is pulled low, the Trace Memory stops tracing program execution. 

The circuitry controlling the Trace Hold input must ensure that set-up and hold 
time requirements are met for reliable operation. The requirements are shown in 
Figure 9-6.1. 

The Trace Hold feature may be used to capture trace data on a selective basis as 
detailed in the following paragraphs. 
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Figure 9-6.1. Trace Hold and Timing 



9-6.1 WINDOW MODE 



Figure 9-6.2. Window Mode Circuit 



MREQ/IORQ 



\ 



TRACE HOLD 

SET -UP: 30 nS Min. 



A 



/ 



r 



HOLD: 20 nS Min. 



AT LEAST 30 nSEC BEFORE THE LOW TO HIGH TRANSITION OF MREQ 
OR IORQ. 



AT LEAST 20 nSEC AFTER LOW TO HIGH TRANSITION OF MREQ OR IORQ. 



Figure 9-6.2 shows a schematic of a simple external circuit that may be used to 
implement window mode operation of the Trace Memory. This circuit controls 
the Trace Hold input of the EM-180 so that only bus activity occurring between 
the Breakpoint A address and the Breakpoint B address is recorded. 



OFF 
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9-6.2 SELECTIVE TRACE 



9-7 SIGNATURE ANALYSIS 



External circuitry may be designed for a variety of selective tracing functions. An 
example is an application in which it is desired to use the capacity of the Trace 
Memory to capture cycles written to a particular I/O port; the I/O port select 
signal (port decode) may be routed to the Trace Hold input to permit Trace 
Memory operation only when the port select signal is active. When execution is 
halted and the Trace Memory contents is reviewed, only bus cycles to the I/O 
port will be seen. 



In 1977, the Hewlett Packard Company introduced a digital servicing technique 
called signature analysis. The signature analysis technique requires first of all that 
the system under test be stimulated to cause repetitive patterns or bit streams to 
occur at various circuit nodes of the system. When such a stimulus is applied, it 
is possible to use an instrument such as the HP 5004A Signature Analyzer to 
observe these bit streams and convert them to four-digit hexadecimal displays on 
the front panel of the instrument. The bit stream, or partem of lows and highs 
present at a given point in a circuit, is the"signature" of that circuit node. Faulty 
components, opens, shorts and other circuit defects will almost always cause 
alteration of a signature that may be observed by the signature analyzer. 

The EM-180 Diagnostic Emulator does not contain circuitry for examining 
signatures at circuit nodes. It does, however, contain pre-programmed stimulus 
routines that may be used to generate the repetitive signals that must be present 
for the signature analysis concept to work. 

Figure 9-7.1 is a simplified microprocessor system diagram and shows an Z-80 
processor two ROMs, one RAM, some I/O circuitry and device enable logic. To 
test a system such as this one, first perform the obvious checks such as 
measurement of the supply voltages and then connect the EM-180 to the circuit. 
The system clock may be checked by using the CODE D2 function; the clock 
frequency displayed by the EM-180 should be one-half of the crystal frequency. 
Now proceed with signature analysis testing by connecting a signature analyzer 
(such as the HP 5004A) to the EM-180 Auxiliary Connector (J3, on the back 
panel of the EM-180) as follows: 

SA GROUND toJE-24 (GROUND) 

SA START toJ3-12 (BKPT A and SA START) 

SA STOP to J3 - 13 (BKPT B and SA STOP) 

SA CLOCK toJ3-25 (SIGNATURE CLOCK) 

The selector switches for the START, STOP and CLOCK signals on the 

fu^f!o r< ;™ alyZer Shquld be Set for ^-tohfch edge recognition (buttons out on 
the HP 5004A) . 
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BINARY ADDRESS TEST (FREE-RUN) 

The EM- 180 Diagnostic Emulator has a built-in mode which places the CPU in a 
free-run condition by inserting continuous NOP instructions into the CPU. As a 
result, tiie processor outputs successive addresses, along with the RD signal; this 
mode is useful as a signature analysis stimulus routine because it stimulates all of 
the address lines in the system and since the RD signal is active, any devices 
in an operating system will drive the data bus when appropriate addresses 
are present. 

To start with, set both the A and B breakpoint comparators so that they will 
respond to READ cycles at address 0000 16 (See Section 4-1.4). Next, start the 
binary address routine by depressing the keys for CODE B5. The EM-180 will 
begin to output incrementing addresses; a SA START pulse and an SA STOP 
pulse will occur each time address 0000 16 is output. The stimulus and signature 
analyzer are now ready for use. 

At this point, the address bus signals may be probed with the signature analyzer 
and each should display its characteristic signature. The various device enable 
signals may be probed and, if the system circuitry is working correctly, 
characteristic signatures will be obtained. Various nodes internal to the Device 
Enable Logic may also be probed; in short, any circuit point may be tested 
where the signal present is determined by the address inputs and the RD signal. 

In most cases, the data bus cannot be tested with this setup because the data bus 
signals are not determined by addresses for all possible address values. For 
example, some addresses may result in floating the data bus; other addresses 
may select RAMs whose contents are not known. Therefore, to test the data bus 
using the signature analysis technique, it is necessary to restrict the start-stop 
window of the signature analyzer so that the data bus is sampled only when 
addresses are present that should result in known data on the bus. 

Suppose that it is known that ROM 1, in Figure 9-7.1, is enabled by the Device 
Enable Logic for any address in the range from 1000 l6 to 17FF, 6 . If the SA 
START signal could be generated when the incrementing address reaches 
1000, 6 and the SA STOP signal generated when the incrementing address 
reaches 17FF 16 , then signatures would be computed only during the time the 
data bus contained deterministic data. The SA START and SA STOP signals 
may be easily adjusted to occur at any desired addresses by setting the 
appropriate breakpoint values into the A and B breakpoint comparators. For the 
example just given, set the A comparator to respond to READ cycles at address 
1000 I6 and set the B comparator to respond to READ cycles at address 17FF 16 . 
Then test the eight data lines to obtain the characteristic signatures. Note that the 
signatures obtained depend not only on the details of the circuitry of the system 
under test, but also on the contents of the ROM involved; consequently, this test 
also verifies that the ROM contains the same pattern as the ROM for which the 
reference signatures were originally obtained. 
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The EM- 180 also has a built-in test function for obtaining a signature of a ROM 
in a system, and no signature analyzer is needed. The test is set up by entering 
the first and last address of the ROM into the BEG and END registers of the 
EM-180 to define the range over which the routine will operate. Then start the 
routine with the Keys for CODE D3. The routine will execute and then display a 
four-digit hexadecimal signature on the EM-180 front panel. The signature 
obtained does not have any simple relationship to signatures obtained with the 
HP 5004A; for one thing, the CODE D3 algorithm operates on all eight data 
bits of the ROM word simultaneously while the eight signatures obtained by the 
HP 5004A for a ROM are computed from one"bit slice" of the ROM at a rime. 
In addition, the generating polynomial used by the EM-180 routine differs from 
that used by the HP 5004A. See Section 7-4 for additional information. 

Other routines that are programmed in the EM-180 Diagnostic Emulator may be 
useful as stimulus routines for signature analysis testing. The CODE B4 routine 
repetitively stores a data pattern and the complement of that pattern to a 
selected address. An I/O port, such as the one shown in Figure 9-7.1, may be 
tested by storing the complementing data to the I/O port and observing the 
signatures obtained at the output side of the I/O port. 

In special cases it may be found necessary to write custom CODE function 
routines to stimulate a system in a way that useful signatures may be obtained. 
As an example, consider the problem of obtaining a signature at the outputs of 
an LSI interface chip such as the Zilog PIO. This device requires that various 
control registers and data direction bits be set up for the intended application 
before data transfers are performed. A custom CODE Function routine can 
easily perforin the desired set-up and then generate the stimulus for signature 
analyzer probing. 

For additional information on Signature Analysis testing, see the following 
publications: 

1. "Hexadecimal Signatures Identify Troublespots in Microprocessor Systems", 
Gary Gordon and Hans Nadig. ELECTRONICS, March 3, 1977. 

2. Application Note 222, "A Designer's Guide to Signature Analysis", Hewlett 
Packard Corporation. 
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9-8 SOFT SHUTDOWN 
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In some applications it is desirable to halt emulation of the target program when 
a particular event occurs or when a particular address is reached; after this, it is 
necessary that the processor execute a program to shut down the target system 
equipment in an orderly manner. For example, there may be hammer driver 
coils which would burn up if left energized. The EM- 180 may be configured to 
operate in systems with requirements like these by writing the needed soft 
shutdown routines and programming them into an EPROM that is then plugged 
into the Diagnostic PROM socket. A small Code Function program is also 
required to insert the re-entry jump instruction into the EM-180 internal 
scratchpad RAM (see sec. 8-5.4, Re-entry Jump). When enabled, the soft 
shutdown routine would be executed every time the emulator transfers from 
RUN to PAUSE, and also after each single-step instruction execution. After 
executing, the soft-shutdown subroutine should exit to the monitor routine with a 
return instruction. 
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«^-ode l-unctions 

GROUP A: MEMORY TESTS 



Al 
A2 
A3 
A4 

AS 
A6 

A7 
AS 



RAM TEST 
RAM TEST 
RAM TEST 
ALL RAM TESTS 
ALL RAM TESTS 
RAM TEST 
RAM TEST 
RAM TEST 



(OO/FF) 
(Rotating l's) 
(Addresses) 



(OO.Fr) 
(Rotating l's) 
(Addresses! 



> -Repeating Tcsls 



One Pass and Stop 



GROUP B: OSCILLOSCOPE LOOPS 

B 1 . Repetitive Memory Read 

B2 Repetitive Memory Write 

B3 Repetitive I O Read 

B4 Repetitive 1 O Write 

Bo Continuous Address Increment, 64K Range 

B6 Repetitive Memory Write (Data Data) 

B7 Repetitive I O Write (Data , Data! 

B9 Continuous Address Increment with Adjustable Rancje 

BC Repetitive Store/Examine Memory 

BD Repetitive Store/Examine I/O Port 

BE Stoic Rotac.r.9 1-Bit to Memory 

BF Store Rotating 1-Bit to I O Port 

GROUP C; MEMORY LOAD AND DUMP 

C! Load Target from Front Panel PROM 

C2 Verity Target with Front Pane. PROM 

C3 Load Target from Serial Link (DOWNLOAD) 

C4 Dump Target !o Serial Link (UPLOAD) 

C5 Load RAM Overlay from Target 

C6 Verify RAM Overlay with Target 

C7 Verify Target Against Serial Link 

C-B i ;■! Target with Specified Data 

C9 Verify Target with Specified Data 

CB Block Move Target System Data 

CC Dump Target to Serial Link in User Viewable Format 

CE Repeat Segment of Data Over an Entire Block 



GROUP D: MISCELLANEOUS CODE TUNC llOtSiS 

DO Clear Interrupt Enable Flip Flop 

Dl Set Interrupt Friable Flip Flop 

1)2 Display Clock Frequency 

D3 Display PROM/ROM Signature 

D4 Output 50 Nulls from Serial Link 

D5 Call User Routine in Internal RAM at 3000,6 

D6 Call User Routine in Internal RAM at 3003k, 

D7 Clear Trace Memory 

D8 Dump Entire Content ol Trace Memory 

D9 Halt CPU (lor changing Front Panel PROM) 

DA Display Revision Number tor Control PROM 

DB Display Revision Number lor Disassembly PROM 

DC Calculate Branch Offset and Display 

DD Do Self-Test of Control PROM and Disassembly PROM 

DE Output (CR) (LF) (NUL) (NUL) from Serial Link 

DF Count Flours. Minutes and Seconds on Display 



GROUP E: DISASSEMBLY 



CODE 
FUNCTION 

HO 

El 

i/ 

r/3 



REGISTERS DISPLAYED 

Flags, A. BC, DE, HL. SP 
Flags, A, BC, DE, ML 
Flags, A. BC, DE, HL. IX. [Y 
SP. Flags', A', BC, DE', HL' 



FORMAT 

(Disable Disassembly) 
80- Character Line 
72 Character Line 
Two 72 Character Lines 



GROUP F: 

F 

F0 

through 
F9 



INTROSPECTION MODE 

Set Basic "Introspection" Mode 

Set Introspection Mode and Initialize Emulator for 
Debug of User Code Function Program 




DEFAULT 

SWITCH SETTING DESCRIPTION 

1.2 CLOSED RAM Overlay outputs data to target system 

during read cycles 

3 CLOSED Ignore "CTS" line during aerial transmission 

4 CLOSED Target system reset will reset emulator 

5 CLOSED Keyboard reset enabled to target system 
6,7 OPEN 8-bit serial transmission. 

8 CLOSED 1 slop bit for serial transmission 



Set-up Characteristics for Serial Transmission 



SW6 





i 
o 



1 
I 



SW7 



SWS 



1 


1 



1 





DATA BITS PER 
CHARACTER 

5 * 
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6 * 
6 * 
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Normal Setup 



CLOSED 0. OPEN 1 

*Standard EM- 180 communications svftivare requires at least 1 bits 

jor operation. 



Auxiliary Connector 
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PROTECTIVE GROUND 
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SERIAL DATA (OUT) 


15 






(RS-232C) 
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SERIAL DATA (IN) 
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(RS-232C) 
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REQUEST-TO SEND 
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(OUT) (RS-232C) 


20 


DATA TERMINAL READY 
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CLEAR TO-SEND (IN) 




(OUT) (RS-232C) 




(RS-232C) 


21 




6 


DATA-SET-READY 


22 


RUN (OUT) 




(NOT IMPLEMENTED) 


23 
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SIGNAL GROUND 
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(RS-232C) 


25 


SIGNATURE CLOCK 
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(ASYNCHRONOUS) 
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EXT BREAK-IN 
(SYNCHRONOUS) 






11 


TRACE HOLD (IN) 
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BKPT A and SA START 
(OUT) 






13 


BKPT B and SA STOP 
(OUT) 







Pins without associated signals shown are not connected within 
theEM-ISOB. 
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MEMORY BLOCK 


SWITCH 


MEMORY BLOCK 


POSITION 


ADDRESS 


POSITION 


ADDRESS 





0O00i 6 -OFFF, 6 
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8000i6-8FFF 16 
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1000,6- IFFF16 
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9000i6-9FFF 15 
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2000i 6 -2FFFi 6 
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A000i6-AFFF 16 
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3000i6-3FFFi 6 
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B000 16 -BFFF 16 
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4000,6-4FFF, 6 
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C000i6-CFFF, 6 


5 


5000 ]6 -5FFFi 6 


D 


DO00i6-DFFF 16 


6 


6000i 6 -6FFF l6 


E 


E000, 6 -EFFF, 6 


7 


7000, 6 -7FFFi 6 


F 


F000 16 -FFFF 16 
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